Compromised eMudhra Certificates: Update Your JetBrains IDEs, ReSharper, etc.
Comments on “Compromised eMudhra Certificates: Update Your JetBrains IDEs, ReSharper, etc.”
Claim-checked. Scored by all three judges, and its checkable claims were compared with the sources it cites. How far stories are checked
JetBrains says private keys for eight eMudhra intermediate certificates were compromised, letting a network attacker impersonate services its tools contact. IDEs, Toolbox App, Gateway and ReSharper are affected because they use the bundled runtime's trust store, so OS updates don't help. Fixes cover IDEs 2025.2 through 2026.3 RC, Toolbox 3.9.1 and 3.8.2, and the jetbrainsd service 0.9.9728. Older versions get no fix. JetBrains reports no known exploitation; the CVE details and several claims were not independently verified.
Why it ranked
No. 6 of 111 with a score of 0.74. The panel rated it highest on practical relevance (0.91) and substantiated (0.89), lowest on audience breadth (0.57). Placed No. 6, No. 7 by score alone: the fourth Security story of the day (−0.020). The placement terms move stories; they are not part of the score.
- AI judgeJudge 2claude-haiku-5-5
- Security advisory on compromised eMudhra CA certificates affecting JetBrains IDEs and runtimes; concrete fix versions and actionable remediation steps, though it is vendor-specific advisory text rather than broad news.
- AI judgeJudge 3gpt-5.6-luna
- A primary, highly actionable security advisory explains affected trust stores, fixed versions, workarounds, and verification details. It is narrower than the broader eMudhra incident coverage but adds important IDE-specific remediation.
Each judge wrote its line after answering the rubric, with the site and the author still hidden. Every answer behind this is in the table under Score.
Score
0.74total under rubric v2.3
- Significance0.66
- Reader interest0.80
- Audience breadth0.57
- Practical relevance0.91
- Substantiated0.89
- Technical depth0.80
- New information0.74
- Counts against: Promotional0.04
- Counts against: Overclaim0.11
Each judge’s answer per question (0–1), their mean and spread, and what the question adds to the score (weight × mean).
| Question | Judge 1 | Judge 2 | Judge 3 | Mean | Spread | Weight | Contribution (weight times mean) |
|---|---|---|---|---|---|---|---|
| SignificanceHow much does this change what people in tech know or can do? | 0.71 | 0.55 | 0.72 | 0.66 | 0.17 | +0.24 | +0.158 |
| Reader interestWould a well-informed senior engineer or tech founder want to read this today, and likely pass it on? | 0.79 | 0.70 | 0.90 | 0.80 | 0.20 | +0.26 | +0.207 |
| Audience breadthHow many people who build technology does it concern? | 0.62 | 0.60 | 0.48 | 0.57 | 0.14 | +0.13 | +0.074 |
| Practical relevanceHow useful is it to someone who builds software or tech products? | 0.98 | 0.85 | 0.90 | 0.91 | 0.13 | +0.22 | +0.200 |
| SubstantiatedHow well is it backed? Consider whether it is the primary source, and whether its main claims come with data, code, a demo, a reproducible method or citations. | 0.85 | 0.85 | 0.98 | 0.89 | 0.13 | +0.05 | +0.045 |
| Technical depthHow technically substantive is it? | 0.99 | 0.70 | 0.72 | 0.80 | 0.29 | +0.05 | +0.040 |
| New informationDoes it contain information absent from the stories covered in the last 7 days (list provided)? | 0.75 | 0.60 | 0.88 | 0.74 | 0.28 | +0.05 | +0.037 |
| PromotionalIs it mainly marketing with little substance (a press release, ad or sponsored post with no real information)? A launch post that carries real news is not promotional. | 0.05 | 0.05 | 0.03 | 0.04 | 0.02 | −0.19 | −0.008 |
| OverclaimDo the headline or conclusions claim more than the body supports? | 0.20 | 0.10 | 0.02 | 0.11 | 0.18 | −0.11 | −0.012 |
| Sum of contributions | +0.741 | ||||||
| Claim-check penalty | 0.000 | ||||||
| Total, as published | 0.741 | ||||||
Spread is the highest minus the lowest judge answer. marks a spread above 0.40: the judges disagree, and the story is marked contested.
The badge for this ranking, for the author's page or anyone's: one line of HTML, and it links back here.
<a href="https://rubric.hrih.si/editions/2026-10-31/6/"><img src="https://rubric.hrih.si/badge/2026-10-31/6.svg" alt="Ranked #6 on Rubric, 31 Oct 2026" width="238" height="28"></a>Claim check
Claim check: 1 matches source · 4 no source given · 3 couldn’t check. Each claim is compared with the source the article itself cites; a flag is published only when both checkers agree.
Matches sourceDate
In October 2026, the private keys of eight intermediate certificates issued by the certificate authority eMudhra were compromised.
The cited source says the same thing.
The article says “In October 2026, the private keys of eight intermediate certificates issued by the certificate authority eMudhra were compromised”
The source says “The private keys of eight eMudhra intermediate CA certificates have been compromised”
Source cited by the article: emudhra.we-have-a-problem.com
Couldn’t checkVersion
JetBrains integrated Oracle's fixes for CVE-2026-91403 and CVE-2026-114820 into JetBrains Runtime as-is.
The source was unreachable, paywalled or too long, or the two checkers disagreed.
The article says “We’ve integrated Oracle’s fixes for CVE-2026-91403 and CVE-2026-114820 into JBR as-is”
The source says No passage could be compared.
Source cited by the article: oracle.com/security-alerts/alert-cve-2026-91403.html
Couldn’t checkVersion
In fixed versions of 2025.3 and later, the embedded browser receives Chrome's certificate updates that block the compromised certificates (CVE-2026-118696).
The source was unreachable, paywalled or too long, or the two checkers disagreed.
The article says “In the fixed versions of 2025.3 and later, the embedded browser now receives Chrome’s certificate updates, which block the compromised certificates”
The source says No passage could be compared.
Source cited by the article: cve.org/CVERecord
Couldn’t checkVersion
The jetbrainsd background service is fixed separately in version 0.9.9728, tracked as CVE-2026-118697.
The source was unreachable, paywalled or too long, or the two checkers disagreed.
The article says “We’ve released a separate fix in jetbrainsd 0.9.9728, tracked as CVE-2026-118697”
The source says No passage could be compared.
Source cited by the article: cve.org/CVERecord
No source givenCausal conclusion
JetBrains IDEs, the Toolbox App, Gateway and ReSharper are affected because they use the trust store of the bundled JetBrains Runtime, so operating system updates don't protect against the issue.
The article gives no link or citation for it.
The article says “JetBrains IDEs check certificates against the trust store of their bundled runtime, JetBrains Runtime (JBR), so updating your operating system doesn’t protect against this issue”
The source says No source to compare with.
No source givenGeneralization
JetBrains is not aware of any exploitation of this issue against JetBrains users at the time of publishing.
The article gives no link or citation for it.
The article says “At the time of publishing, we are not aware of any exploitation of this issue against JetBrains users”
The source says No source to compare with.
No source givenVersion
IDE versions 2025.1 and earlier, and Toolbox App 3.7 and earlier, will not receive the fix.
The article gives no link or citation for it.
The article says “IDE versions 2025.1 and earlier, and Toolbox App 3.7 and earlier, will not receive this fix”
The source says No source to compare with.
No source givenVersion
The Toolbox App fixed versions are 3.9.1 and 3.8.2.
The article gives no link or citation for it.
The article says “Toolbox App 3.9.1, 3.8.2”
The source says No source to compare with.
Also covered by
No other coverage was clustered with this story.
Elsewhere
Elsewhere: HN 5 pts, not on front page
Recorded for context only, checked 31 Oct 2026, 05:46 UTC. It played no part in the ranking.