Compromised eMudhra Certificates: Update Your JetBrains IDEs, ReSharper, .NET Tools, Toolbox App, and Gateway Now

In a significant security development affecting the global developer ecosystem, the private keys for eight intermediate certificates issued by the certificate authority eMudhra were confirmed compromised in October 2026. This security breach presents a substantial risk to software integrity, as an attacker capable of intercepting network traffic could leverage these compromised keys to impersonate legitimate websites, services, and secure communication channels. Because JetBrains IDEs and their associated development tools verify certificates against a custom, bundled trust store—the JetBrains Runtime (JBR)—standard operating system security updates are insufficient to mitigate this threat. Users must manually update their JetBrains development environments to ensure the compromised certificates are effectively blocked and no longer trusted.

Chronology and Nature of the Incident

The incident originated when the private keys of the aforementioned intermediate certificates—entities that bridge the gap between root Certificate Authorities (CAs) and end-entity certificates—were exposed. The nature of this exposure, occurring in October 2026, allows malicious actors to perform sophisticated Man-in-the-Middle (MitM) attacks. In such a scenario, an attacker positioned between a developer’s machine and a target server could present a fraudulent certificate that appears valid, thereby decrypting, monitoring, or even altering data in transit.

The security risk is particularly acute for software developers who frequently connect to remote repositories, build servers, and cloud infrastructure. The compromise necessitates a complete revocation of trust for the affected eMudhra certificates. JetBrains responded to the vulnerability by integrating emergency patches derived from Oracle’s recent security alerts regarding CVE-2026-91403 and CVE-2026-114820 directly into the JetBrains Runtime.

The Role of JetBrains Runtime and JCEF

A critical aspect of this security vulnerability is the architectural design of JetBrains’ software. Unlike many desktop applications that rely on the host operating system’s certificate store, JetBrains products utilize the JetBrains Runtime (JBR) for certificate verification. This internal trust store operates independently of Windows, macOS, or Linux system updates. Consequently, even if a user has updated their operating system to the latest patch level, their IDE remains vulnerable unless the runtime environment itself is updated.

Furthermore, the embedded browser component—JetBrains Chromium Embedded Framework (JCEF)—presents a separate vector of risk. In fixed versions of IDE releases from 2025.3 onwards, the browser is configured to fetch certificate revocation lists directly from Google’s update servers. While this mechanism is designed to automate the blocking of compromised certificates (as tracked under CVE-2026-118696), it creates a dependency on network connectivity to Google’s infrastructure. Users operating behind strict firewalls or in environments where Google’s update servers are inaccessible may find their embedded browser remains unprotected, requiring manual intervention to disable JCEF functionality until a formal hotfix can be deployed.

The Vulnerability in Background Services

The security implications extend beyond the IDE interface to the background management utility, the jetbrainsd service. This service, which manages updates and background operations for the Toolbox App and various IDEs, maintains its own built-in list of trusted certificates. Because this list is hardcoded into the service itself, traditional JBR updates do not influence its security posture.

JetBrains has released version 0.9.9728 of the jetbrainsd service to address this specific vulnerability (CVE-2026-118697). Because only one instance of jetbrainsd typically runs per user session, updating a single JetBrains application to a version that includes the 0.9.9728 service effectively remediates the vulnerability for all other JetBrains applications on that user’s machine. Users are advised to prioritize updating their Toolbox App to at least version 3.9.1 or 3.8.2 to ensure this service is patched.

Mitigation and Action Plan for Developers

For the majority of users, the primary path to security is to perform a standard update to the latest bugfix release of their current IDE version. JetBrains has confirmed that fixes are available for versions ranging from 2025.2 through to the 2026.3 Release Candidate. Developers relying on legacy environments, specifically IDE versions 2025.1 or earlier, are at risk; these versions are considered end-of-life regarding security patches and will not receive the necessary updates. Such users are strongly encouraged to migrate to a supported version immediately to ensure their development pipeline remains secure.

For those who are unable to update their IDE immediately, manual intervention is required. This involves:

1. Cleaning the Certificate Store: Users must manually remove the two eMudhra-related root certificates from the JBR trust store.
2. Disabling JCEF: If the IDE cannot reach Google’s update servers to pull the latest certificate blocklist, users should navigate to the IDE settings to disable JCEF. It is important to note that this action will disable features dependent on the embedded browser, including Markdown previews, HTML rendering, and Jupyter notebook output. Once a patch is applied, JCEF functionality can be safely re-enabled.
3. Manual jetbrainsd Update: If neither the Toolbox App nor the IDE can be updated, the background service must be updated manually via the command line or file replacement, as detailed in the official JetBrains security advisory.

Broader Implications for Development Environments

The incident underscores the growing complexity of the software supply chain. When an intermediate CA is compromised, the impact is not limited to web traffic but ripples outward to affect developer tooling, CI/CD pipelines, and automated build processes.

Project-specific JDKs and external tools that bundle their own runtimes—such as Node.js, Go, or Python—are not covered by the JetBrains patch. Developers are responsible for auditing these environments separately, following the security recommendations provided by the respective vendors of those tools. Failure to account for these secondary runtimes could leave a developer’s local environment exposed, even if the IDE itself is fully secured.

Professional Responsibility and Future-Proofing

The rapid response required in this instance highlights the importance of maintaining up-to-date development environments. The shift toward agentic engineering—where developers increasingly rely on AI-driven tools and automated background services—means that the "attack surface" of a developer’s machine is broader than it was a decade ago.

This breach also serves as a stark reminder of the "comprehension debt" that exists in modern development. As developers offload the management of their toolchains to automated services and IDE managers, the underlying security mechanisms—such as the specific way a runtime verifies a certificate—can become opaque. When a security event occurs, the ability to quickly understand and respond to these technical requirements is not just a secondary task; it is a core competency of the modern professional software engineer.

The JetBrains Support team remains the primary point of contact for developers facing difficulties with these updates. While the manual workarounds provide a temporary safety net, the consensus among security researchers is that full, version-based updates are the only reliable way to maintain the integrity of a development environment against the sophisticated threats posed by compromised certificate chains. Given the ubiquity of JetBrains IDEs in professional software development, the urgency of this update cannot be overstated. By ensuring that runtimes, plugins, and background services are current, developers protect not only their local source code but the broader software supply chain that their applications ultimately feed into.