Upstream Security Advisory · 21 October 2026
CA Certificate Security Update — Saphira Linux
Eight eMudhra intermediate CA private keys were compromised through weak key generation. This is an upstream certificate-authority incident, not a defect in Saphira Linux.
What Saphira users should do
- Affected component
- System CA certificate bundle
- Verified package
ca-certificates-20261020-r2in the current Hatched repository; the published APK signature validates against Saphira's repository key.- Action
- Refresh package metadata, then install available upgrades.
apk update
apk upgradeapk update refreshes repository metadata. apk upgradeinstalls available package upgrades. Keeping systems current is the ordinary, useful response here.
What happened
Compromise of the eight eMudhra intermediate CA keys could allow fraudulent certificates to be issued. Where adequate revocation protection is unavailable, a client that still trusts the relevant chain may not have enough information to reject a fraudulent certificate.
Saphira published the updated ca-certificates-20261020-r2 package on 21 October. Its system bundle is relevant to software such as curl, PHP, and other TLS clients that use the operating-system trust store.
An important trust-store boundary
The operating-system certificate bundle and browser-specific emergency distrust are separate controls. Browser vendors can apply targeted distrust rules that are not the same thing as a system trust-store package update.
The published Saphira package is signed and current. However, comparison with the preceding bundle does not establish independent system-level distrust of the compromised eMudhra intermediates, so Saphira does not make that claim. Keep both your operating system and browsers updated.
Authoritative references
Need help maintaining or modernising PHP?
AKADATA LIMITED provides PHP maintenance, security updates, code reviews, performance improvements and application modernisation. Contact us if your infrastructure or application needs engineering assistance.
This is an optional commercial service, not a requirement for using Saphira Linux. Contact AKADATA LIMITED support →