Security News

Java users urged to update after eight eMudhra certificates compromised

Australian Cyber Security Magazine · 23 Oct 2026

Key Takeaway List every place Java runs in your business, including embedded and containerised copies, and apply the vendor update or documented workaround as soon as possible.

Azul has issued an out-of-cycle security update after eight eMudhra intermediate Certificate Authority certificates were compromised, as publicly disclosed on 20 October 2026. The certificates could potentially be used to impersonate trusted websites and services. Azul said the affected private keys were generated defectively, which allowed them to be derived from public certificates. eMudhra has revoked the certificates, and Apple, Google, Microsoft and Mozilla have blocked them in browsers and operating systems.

The concern for businesses is that Java runtimes do not check certificate revocation by default. Azul said unpatched Java Development Kits (JDKs) may accept forged certificates signed with the compromised keys, because the intermediates chain to roots trusted by many OpenJDK distributions. eMudhra stated only one of the eight intermediates was used in production and none issued end-entity certificates, while Google reported finding no certificates chaining to them in Certificate Transparency logs.

Azul released tested updates within 24 hours of disclosure for Azul Zulu (Java 27, 25, 21, 17, 11, 8, 7 and 6) and Azul Prime (Java 25, 21, 17, 11 and 8). The fix is a block list file that can be applied through a JDK update or placed manually in each installed runtime, including copies embedded in applications, container images and CI pipelines, followed by a restart. Azul also published a documented workaround for environments that cannot be updated immediately.

Java Certificate Authority Azul eMudhra Patch Management

Summarised by CISO AI from Australian Cyber Security Magazine, written with Claude Sonnet 5.5. We link back to every original so you can read it yourself.