Trending:
OpenAI admin controls GitHub Issues agent approvals Gemini in Chrome UK expansion Developer tools coverage
TECHSTAGED Better software. Smarter business.

Compromised eMudhra Certificates: What readers can understand and decide beyond the JetBrains announcement

By TechStaged

· 3 min read

Prepared with AI assistance from source material. Automated editorial review recorded . Automated checks can miss errors and do not represent human approval. Editorial policy and corrections.

JetBrains tools update after compromised eMudhra certificates
TechStaged-owned

Summary

  • The private keys of eight eMudhra intermediate certificates were compromised.
  • A network attacker could impersonate websites and services JetBrains tools connect to.
  • JetBrains IDEs, the Toolbox App, Gateway, and ReSharper are affected because they use the trust store of the bundled JetBrains Runtime (JBR).
  • For IDEs, the embedded browser (JCEF) is also affected.

JetBrains confirms that eight eMudhra intermediate certificate private keys were compromised, enabling a network attacker to impersonate websites and services JetBrains tools connect to.

The issue affects JetBrains IDEs, the Toolbox App, Gateway, and ReSharper because they rely on the trust store in JetBrains Runtime (JBR). For IDEs, the embedded browser (JCEF) is also affected. OS updates do not provide protection against this issue.

WHICH PRODUCTS ARE AFFECTED AND WHY THEY’RE AFFECTED

JetBrains IDEs, the Toolbox App, Gateway, and ReSharper all use the trust store of the bundled JetBrains Runtime (JBR). This means they inherit the compromised certificates if not updated. The embedded browser in IDEs (JCEF) is also affected.

WHAT FIXES EXIST AND WHICH VERSIONS ARE PATCHED

The issue is fixed in the following versions across JetBrains products: IntelliJ IDEA: 2026.3 RC, 2026.2.4, 2026.1.5.1, 2025.3.6.2, 2025.2.6.4; PyCharm: 2026.3 RC, 2026.2.4, 2026.1.5.1, 2025.3.6.2, 2025.2.6.3; PhpStorm: 2026.3 RC, 2026.2.4, 2026.1.5.1, 2025.3.6.2, 2025.2.6.3; RubyMine: 2026.3 RC, 2026.2.4, 2026.1.5.1, 2025.3.6.2, 2025.2.6.3; WebStorm: 2026.3 RC, 2026.2.4, 2026.1.5.1, 2025.3.6.2, 2025.2.6.3; Rider: 2026.3 EAP 9, 2026.2.4, 2026.1.5.3, 2025.3.5.3; CLion: 2026.3 RC, 2026.2.4.1, 2026.1.5.2, 2025.3.6.3, 2025.2.6.3; DataSpell: 2026.1.3.1, 2025.3.3.1, 2025.2.4.1; DataGrip: 2026.3 RC, 2026.2.6.1, 2026.1.4.1, 2025.3.6.1, 2025.2.6.1; GoLand: 2026.3 RC, 2026.2.4, 2026.1.5.1, 2025.3.5.2, 2025.2.6.3; RustRover: 2026.3 EAP 8, 2026.2.5, 2026.1.4.1, 2025.3.7.1, 2025.2.6.1; Gateway: 2026.3 RC, 2026.2.4, 2026.1.4, 2025.3.3, 2025.2.6; ReSharper: 2026.3 EAP9, 2026.2.4, 2026.1.5.3, 2025.3.5.3; The 2025.2.6.* updates contain only the JBR fix and will receive a separate hotfix for the JCEF problem.”],

WHAT IF YOU CAN’T UPDATE RIGHT AWAY? WORKAROUNDS AND HOW TO PROCEED

If you cannot update due to network restrictions or other constraints, JetBrains provides workarounds including disabling the embedded browser (JCEF) in the IDE where possible, and updating the JetBrains Daemon (jetbrainsd) to 0.9.9728.

  • Update the JetBrains Daemon (jetbrainsd) to 0.9.9728 or later to apply the fix for the background service’s certificate list.
  • If you cannot update the IDEs right away, you can use the provided manual steps to replace the built-in certificate list for the affected components and launch the IDE with a modified trust store.
  • For Toolbox App users, note that versions 3.7 and earlier won’t receive the fix; update to a fixed version (3.9.1 or 3.8.2) when possible.
  • If you use JetBrains Gateway, update it to 2026.1.4, 2025.3.3, or 2025.2.6 to receive the fix.
  • For those using JetBrains Runtime directly, update to fixed builds: jbr25.635.79, jbr25.508.41, jbr25.329.142, jbr21.1163.125, jbr21.1038.91, as listed in the release notes.
  • If you still can’t update, consider turning off the embedded browser (ide.browser.jcef.enabled) and restarting the IDE after updating.
  • Note that turning off the embedded browser affects features like Markdown/HTML previews and some plugins; re-enable after updating to a fixed version.

HAS ANYONE EXPLOITED THE ISSUE YET?

JetBrains notes that, at publication time, there was no known exploitation against JetBrains users.

WHAT HAPPENS NEXT AND HOW TO VERIFY YOU’RE PROTECTED

Update to the latest fixed bugfix releases for your IDEs and related tools to ensure the Jira (JBR) updates and the jetbrainsd fix are applied.

If your network blocks Google’s update servers, you may need to use the workaround described above to disable JCEF until you can update to a fixed version.

After updating, verify you are on a fixed version set and that the two compromised roots no longer appear in your runtime certificate trust store.

HOW TO VERIFY YOUR INSTALLATION STATUS

Consult the version numbers listed for each product in the JetBrains advisory to confirm you are on a fixed build (e.g., IntelliJ IDEA 2026.3 RC or newer, and other products listed).

Check that jetbrainsd is at 0.9.9728 or newer for the background service mitigation and ensure your trust store updates have been applied.

SOURCES

Developer Tools Vercel AI Gateway Adds Regional Inference for US and EU Data Residency • 2 min read Developer Tools AI Conformance in Kubernetes moves to SIG Architecture: what the evidence shows beyond the announcement • 2 min read Developer Tools Beyond the GA headline: what the verified evidence says about GitLab Orbit’s impact on agents and costs • 2 min read Developer Tools Vulnerabilities outpace fixes: what verified evidence says about automating remediation inside the software factory • 3 min read Security Claude Code extension incident: what verified evidence shows beyond the announcement • 3 min read Security ESC1 and ESC8 intrusion paths: what the Microsoft Security Blog reveals beyond the announcement • 1 min read Security CISOs in the agentic era: evolving leadership for AI-enabled risk • 2 min read Developer Tools Explainer: How Meta’s PrivacyLib enforces privacy at the Data Access Boundary (revised) • 4 min read