# Critical Security Update for JetBrains Tools Following eMudhra Certificate Compromise

Update your IDEs and background services immediately to mitigate potential network impersonation risks.

- **Source:** [The JetBrains Blog](https://brifing.si/source/782eebd1-7be8-49cc-b27c-e552516691b2)
- **Published:** 2026-10-30
- **Topic:** [Software & Engineering](https://brifing.si/c/engineering)
- **Original article:** <https://blog.jetbrains.com/security/2026/10/compromised-emudhra-certificates-ides/>
- **On Brifing:** https://brifing.si/s/2d6984a6-7e1b-4d04-8abf-c38e93d1d9b8

## Compromised eMudhra Private Keys

In October 2026, private keys for eight intermediate certificates issued by eMudhra were compromised. This security vulnerability allows attackers to perform man-in-the-middle attacks by impersonating legitimate websites and services. Because JetBrains tools rely on their own bundled runtime trust stores, standard operating system security updates do not mitigate this specific threat.

## Impacted JetBrains Software Ecosystem

The compromise affects JetBrains IDEs, ReSharper, Gateway, and the Toolbox App. These applications utilize the JetBrains Runtime (JBR) and embedded browsers (JCEF), which previously trusted the compromised root certificates. Users running versions 2025.1 or earlier, along with Toolbox App 3.7 and earlier, are not eligible for patches and must upgrade.

## JetBrains Runtime Patching Mechanism

JetBrains has integrated Oracle’s fixes for CVE-2026-91403 and CVE-2026-114820 into the JBR. These updates explicitly block the emSign ECC Root CA, emSign Root CA (G1/G2), and AAA Certificate Services. Users must update to the latest bugfix releases, such as 2026.3 RC or 2025.3.6.2, to ensure their runtime environment is secured.

## Background Service jetbrainsd Vulnerability

The jetbrainsd background service maintains a separate, built-in list of trusted certificates, making it immune to standard JBR updates. Users must ensure this service is upgraded to version 0.9.9728 to address CVE-2026-118697. Installing or updating any JetBrains application to a fixed version automatically replaces the old daemon with the secure version.

## Embedded Browser Security Updates

For IDE versions 2025.3 and later, the embedded browser now fetches certificate updates directly from Google’s servers to block compromised entities. If your network environment restricts access to these update servers, the browser remains vulnerable. In such cases, you must manually disable the JCEF feature via the Registry settings until connectivity is restored.

## Manual Mitigation for Legacy Versions

If immediate updates are impossible, users can manually clean the certificate list by removing the affected roots from the cacerts file using the keytool utility. After modifying the keystore, you must update the VM options to point to this cleaned file and ensure the 'Accept non-trusted certificates automatically' setting is disabled.

## Verification and Manual Daemon Updates

To verify your protection, check that the jetbrainsd version is 0.9.9728 or higher using the command line. If the automated update fails, you can download the platform-specific archive and manually replace the binary. Always verify the SHA-256 checksums provided by JetBrains to ensure the integrity of the downloaded security patch files.

## Broader Security Implications

This incident highlights the risks associated with bundled runtimes and isolated trust stores in development environments. Beyond IDEs, developers should audit their project-specific JDKs, Node.js, Python, and Go environments, as these tools often maintain independent certificate stores. Proactive management of these dependencies is essential to maintaining a secure local development infrastructure.

## Sources covering this story

- https://blog.jetbrains.com/security/2026/10/compromised-emudhra-certificates-ides/ — 

---

_Summary written by Brifing from the original reporting. Copyright in the original article belongs to its publisher; read the full piece at the link above._