Executive summary

I just read an announcement from Arch Linux about the ca-certificates-mozilla package that needs to be updated to version ≥ 3.131.1-1. The trigger: an intermediate certificate belonging to Certificate Authority eMudhra was found to be compromised on 20 October 2026, and the announcement was published by David Runge a day later.

Issue being addressed

What caught my attention here is the chain of trust. ca-certificates-mozilla is the package that bundles the Mozilla-style root/intermediate CA store for Arch systems. Once an intermediate CA (in this case eMudhra) has its certificate leaked, anyone holding the private key for that certificate can issue new certificates that are still trusted by any browser or tool relying on that trust store. As long as the system hasn't updated the bundle, that forged certificate remains technically valid — that's what makes a man-in-the-middle attack possible, for example to intercept HTTPS connections that look "secure" even though they've been compromised.

Key features and code example

Arch's fix isn't a code patch but a data update: version 3.131.1-1 has removed/invalidated the compromised eMudhra certificates from the trust store. So the solution is purely about updating the package. Illustration of how to upgrade on Arch Linux:

# ilustrasi, bukan dari source
sudo pacman -Syu ca-certificates-mozilla

Impact and upgrade notes

Arch explicitly states that it's urging everyone to upgrade immediately, since without this update the system remains exposed to MITM risk. There's no breaking change on the API or configuration side — this is purely a trust store data update — so the upgrade risk is low, but the urgency is high because the attack vector hits network traffic directly that appears trusted.

---

First announced on Arch Linux News. Read the original source for full details.

Read also