eMudhra CA compromise: upgrade Archil clients to v0.10.0 or later

What happened and who is affected?

Private keys associated with eMudhra intermediate certificate authorities were compromised. These keys can be used to issue fraudulent certificates for services an attacker does not control. See Mozilla's incident advisory for background.

Archil client v0.9.3 and earlier use an embedded CA trust bundle that can trust certificates issued using these compromised keys. An attacker able to intercept or redirect an affected client's connection could impersonate Archil services and potentially read or modify traffic, including data and credentials transmitted over that connection.

Check every deployment of the Archil disk client, including hosts, container images, and Kubernetes CSI deployments that run the client. A version reported by a separate SDK or tool does not establish the version of the running disk client.

The Node.js SDK package @archildata/native connects to Archil directly and is affected in versions 0.9.3 and earlier. Those versions are deprecated on npm.

Archil sandboxes and serverless exec were patched as of 5:28 p.m. PT on October 22, 2026 and need no action from you.

What do we know about customer data?

As of October 23, 2026, we are not aware of any interception or unauthorized access to customer data associated with this vulnerability. This is a statement of our current knowledge, not a guarantee that exploitation has not occurred.

If you suspect suspicious activity involving an Archil connection, contact security@archil.com.

How to upgrade

1. Update the operating system and its CA trust store. Apply your operating system or distribution's security updates for the eMudhra incident. A browser update alone does not establish that the Archil client's trust store is protected.
2. Install Archil client v0.10.0 or later. Follow the Linux installation instructions or the macOS installation instructions for your deployment. For Linux release signature verification, see Verify Linux downloads.
3. Replace running clients. Replacing a binary on disk is not sufficient for a process that is already running. Pause applications writing to the mount and cleanly unmount before restarting or redeploying the client. On Linux, use archil unmount so pending writes are flushed. On macOS, use the app's Unmount action. Remount with the updated client and verify file access before resuming workloads.
4. Verify the version in every deployment. On Linux, run archil --version in the host or container that runs the client and confirm v0.10.0 or later. For macOS, check the app version. Also check the running connection in the console; checking a newly installed binary alone does not verify an existing mount.

Node.js SDK

Upgrade @archildata/native to 0.10.0 or later, for example with npm install @archildata/native@^0.10.0, and redeploy. Run npm ls @archildata/native to confirm the version your lockfile resolves, including copies installed as a dependency of another package. Restart running processes so they load the new version.

Version 0.10.0 uses the system certificate trust store instead of an embedded CA bundle. Protection also depends on the system trust store and certificate verification rejecting the compromised chains. Keep system trust stores updated; contact support if you cannot confirm protection for your environment.

Containers and Kubernetes

Minimal images may not include a CA trust store. Install or update the ca-certificates package using your distribution's supported package manager, or include an updated CA bundle in your final image if it has no package manager. Ensure it is present in the final runtime image, not just a build stage. Installing the package alone is not proof that the compromised chains are rejected.

Rebuild and redeploy images with the updated client and trust store. For Kubernetes, include the CSI components and node workloads that actually run the client. If the mount runs on a host and is shared into containers, update and restart the host client. See container deployment instructions and the CSI driver documentation.

Do not disable certificate verification to work around connection errors. Contact support@archil.com for help.

Upgrade deadline and service interruption

Starting November 20, 2026 at 12:00 p.m. PST (20:00 UTC), Archil will deny access from clients earlier than v0.10.0. Complete the upgrade and replace running clients before this time to avoid service interruption, including failures to connect or reconnect mounted workloads.

Upgrade immediately rather than waiting for the deadline. Do not rely on an existing mount remaining connected. The server-side version restriction enforces migration; it cannot protect an old client from an attacker impersonating the server.

Update history

• October 23, 2026: Initial advisory published with affected versions, current customer-impact information, upgrade instructions, and the minimum-version enforcement deadline. Customers were first notified by email on October 22, 2026.

Contact

For upgrade assistance, email support@archil.com. Report suspected exploitation or other security concerns to security@archil.com.