Your Server Has More Than One Trust Store

My Ubuntu server installed the eMudhra fix and said done. Its Java keystore had not changed in a year.

The short version

Patched is a property of a trust store, not a machine: on one Ubuntu server with the fixed ca-certificates, Java, Node 24.16, requests and the Azure CLI still trusted eMudhra's computable keys. Test every client in its own environment against all 14 published chains with a control, and on Ubuntu delete /etc/ssl/certs/java/cacerts before update-ca-certificates --fresh. In my tests --fresh alone left the stale roots in place.

The package manager said done, and it was right about the package. Java reads a different file.

Read the essay →

Also worth your time

The Door Was Patched. The Room Was Not.

Langflow's critical RCE was marked fixed in 1.9.0. A second advisory says that only locked the front door.

▪ AI TECH · 16 MIN

The Attestation Was Valid. The Source Wasn't.

Attackers keep shipping malicious npm releases with valid provenance. I tried to break the popular fix, and it broke.

▪ PROGRAMMING · 12 MIN

Nobody Stole the Keys

Bitget's forensic reports describe a tool that filled in its own risk checks. The first fix I tried broke.

▪ CRYPTO · 16 MIN

Hit reply if you want to argue with any of it. It reaches me, not a queue, and I answer.

Cisco

Unsubscribe in one click · Read it on the web
You confirmed this subscription at roamingpigs.com.
RoamingPigs, Inc. · c/o Cisco Caceres, 200 W Sahara Ave, Las Vegas NV 89102