Updated Oct 22, 2026 at 5:14 pm CDT

The sync of updated images to customer registries is complete. Every Chainguard image and Helm chart now carries the new certificate bundle (ca-certificates-bundle 20260909-r3), except the spegel Helm chart, which is still being updated. If you have not pulled and redeployed since October 21, do so now to pick up every updated image in your registry.

Fixes for applications that ship their own list of trusted certificates continue to land. Java: all cacerts fixes are merged and 35 of 37 catalog Java images are rebuilt; the Corretto 21 JRE and Tomcat on Corretto images are still rebuilding. Node.js: 70 of 72 catalog images are on the updated build; Node 22 and 26 are complete, two Node 24 images are still rebuilding, and Node 20 and 25 are waiting on new upstream releases. Python: images that bundle certifi, including the OpenStack images, are being updated to certifi 2026.10.19. Fixes for the Ruby AWS SDK and nmap are in progress.

To confirm an image is fixed, check its SBOM for ca-certificates-bundle 20260909-r3 and use the newest build for the applications above. If you pin by digest, move to the new digest. Full steps are in the remediation guide: https://support.chainguard.dev/hc/en-us/articles/57499369353755-ACTION-RECOMMENDED-Update-all-Chainguard-Images-to-remove-eMudhra-Intermediate-CA-Data. Next update by October 23, 16:00 UTC.

Updated Oct 21, 2026 at 1:05pm CDT

Sync of updated images to customer registries continues. As of 17:51 UTC, 96.5% of the image tags customers actively sync carry the new certificate bundle (ca-certificates-bundle 20260909-r3), up from 95% at 16:06 UTC. We recommend you pull and redeploy now to pick up every updated image already in your registry. We have increased sync capacity, and based on current rates we expect the remaining images to reach customer registries within the next few hours, ahead of our earlier estimate of October 23, 02:00 UTC. We'll notify you when the sync is complete, so you can pull and redeploy again.

A small number of repositories, including pytorch, pytorch-fips and os-shell-iamguarded, have not yet synced. If you pull one of these and still see an older bundle version, check again shortly. Fixes for applications that bundle their own certificates continue to land: the uv fix for Python is merged, gRPC fixes are merged for several images and in progress for the rest, and Node.js is covered in the remediation guide.

For steps to update, confirm the fix, and handle applications that bundle their own certificates, see the remediation guide: https://support.chainguard.dev/hc/en-us/articles/57499369353755-ACTION-RECOMMENDED-Update-all-Chainguard-Images-to-remove-eMudhra-Intermediate-CA-Data. Next update by October 22, 02:00 UTC.

We have updated 99.8% of Chainguard container images to the new certificate bundle (ca-certificates-bundle 20260909-r3), and these images are syncing to customer registries now. We recommend you pull and redeploy now to pick up every updated image already in your registry. We’re adding sync capacity, and based on current rates, we estimate all remaining images will reach customer registries by October 23, 02:00 UTC. We’ll notify you when the sync is complete, so you can pull and redeploy again.

For applications that bundle their own certificates, such as Go, Java, Node.js, and Python’s certifi, see the remediation guide. Next update by October 21, 18:00 UTC.

We continue rebuilding all Chainguard images onto the updated certificate bundle that removes trust in the compromised eMudhra certificate authorities. Nearly all images are rebuilt, and rebuilt images are syncing into customer registries as they complete. We have published a remediation guide with the steps to update, confirm the fix, and handle applications that bundle their own certificates:

KB: Update all Chainguard Images to remove eMudhra Intermediate CA Data

Our image catalog is almost completely rebuilt with updated certificates. However, catalog synchronization and publishing are still underway. Check your registry often to see the build status of your own images. Official communications are coming soon with detailed guidance on impact and workarounds. Check your communication opt-ins in the Chainguard Console to ensure you see them.

We are aware of the recently disclosed compromise of the eMudhra emSign G3 certificate authority, which has been distrusted across the ecosystem (including by Mozilla and the Go project). Our services are operating normally. As a precaution we are actively updating all Chainguard container images to remove trust in the affected certificate authority, matching the wider ecosystem.