[Ethereum Clients Release Security Updates to Fix eMudhra Certificate Vulnerability; Default Mainnet Nodes Unaffected] BlockBeats reported on October 29th that a cryptographic security vulnerability in the Indian certificate authority eMudhra affected the Ethereum clients Teku and Besu. Researchers discovered that the private keys of eight intermediate certificate authorities under eMudhra could be calculated due to insufficient randomness. Attackers could potentially forge certificates and trick unpatched software into trusting malicious services. Teku has released version 26.10.3, and Besu has released version 26.10.2, both removing trust in the relevant certificates from their Docker images. If an attacker launches a man-in-the-middle attack, they could potentially trick some validators into sending block fee rewards to the attacker's address; the risk may be even higher with certain configurations using external signers. The Teku team stated that default-configured Ethereum mainnet Teku nodes are unaffected and no action is required. There have been no reports of exploitation of the vulnerability so far. For operators running Teku or Besu directly on their hosts and not using Docker, simply updating the client may not be enough; they also need to manually update Java and its list of trusted certificates. Operators still using the discontinued Java 26 version will need to migrate to Java 25. [Original Link]