Ethereum developers have rushed out emergency fixes after a cryptography failure at Indian certificate authority eMudhra rippled into the blockchain’s infrastructure. The private keys of eight of eMudhra’s intermediate certificate authorities were shown to be recoverable from their public certificates on October 17, and were revoked the next day — but an attacker with the keys could have impersonated services used by some Ethereum validators and quietly redirected block rewards.
Ethereum (Credits: CoinDesk)
Ethereum Teku 26.10.3 and Besu 26.10.2 Patches: What Changed
Teku, the software many validators use to run Ethereum’s proof-of-stake side, released version 26.10.3 on Tuesday, while Besu, which processes Ethereum transactions, released version 26.10.2 on Monday. Both updates stop trusting certificates tied to eMudhra in their Docker images, the prepackaged versions many operators run.
Validators — the computers that stake ETH to secure Ethereum and earn fees for proposing blocks — talk to other services over the internet and rely on digital certificates to confirm they are reaching the right one. On a Java runtime without the OpenJDK fixes (shipped October 20 and 23), an attacker intercepting a node’s traffic could impersonate an HTTPS endpoint, obtain signatures for voluntary exits or builder registrations that redirect fees, and in worst cases slashable signatures. Teku says no exploitation has been reported and that default Teku mainnet nodes are not affected.
Ethereum Validators: What Operators Need to Do
According to the security notices, Docker users should install the latest Teku or Besu images, while operators running the software directly must update Java separately — or move from the unsupported Java 26 to Java 25. Browsers, operating systems and Go have already blocked the compromised certificates; Java does not check revocation by default, which is why the runtime-level fix was needed.
The incident is a reminder that blockchain security can hinge on the ordinary plumbing of the internet: when a certificate authority stumbles, the consequences can reach far beyond browsers.
Also Read: Bitcoin Holds Below $80,000 as AI Buildout Draws Investor Capital and Fed Meeting Begins
Also Read: Bitcoin-Backed Mortgages Are Coming to Canada in Early 2027
Source: CoinDesk — read the full story there.
