eMudhra Intermediate CAs Compromised — Cycle is not affected but action may be required to secure your workloads

TLDR; The Cycle Platform is not affected as it only communicates with Cycle's own resources and we use our own private certificate authority. But your containers, VMs and potentially even code frameworks may need to be patched/updated/re-built and re-deployed.

Long story not quite so short; Another major security incident has been disclosed and it's affecting pretty much everything.

The private keys for eight intermediate certificate authority (CA) certificates issued by eMudhra were compromised. Intermediate CAs sit between a trusted root and the certificates websites use. Anything an intermediate signs inherits the root’s trust. These eight chain to roots trusted by Mozilla, Google, Apple and Microsoft, which means they’re trusted by default on almost every browser, operating system and container base image in use today.

Update your OS ca-certificates packages, update your container images and re-build & re-deploy and update your language runtimes if they ignore the OS list (at least Python certifi, Golang of certain versions and Rust).

Take a look at this blog for more details and steps to check if you are affected and mitigate your workloads: https://cycle.io/blog/2026-intermediate-ca-compromise