Tails releases emergency update to block compromised eMudhra certificates

The Tails project has issued an emergency security release, version 7.15.1, to protect users from forged certificates issued by the Indian certificate authority eMudhra. The update addresses a vulnerability where eight eMudhra intermediate keys were found to have extremely low entropy, allowing them to be cracked in under a second.

An attacker possessing these compromised certificates could impersonate legitimate HTTPS-protected websites. This poses a significant risk to Tails users if a malicious Tor exit node or a government-controlled network infrastructure attempts to intercept traffic. While the threat is serious for clearnet websites, developers noted that Tor onion services remain unaffected, and there is currently no evidence of active exploitation.

To mitigate the risk, Tails 7.15.1 updates the Tor Browser to version 15.0.26 and updates the Debian ca-certificates package to block eMudhra certificates system-wide. Users running Tails 7.0 or newer are strongly encouraged to upgrade immediately to ensure protection across all applications.