If you are a software engineer or work in tech, you have likely heard about the eMudhra Intermediate CA compromise disclosed on October 20, 2026. You may have noticed a wave of software updates for products you use. Rather than repeat the full background, which is covered in public posts including Mozilla's now-public bug report, this piece focuses on the impact on Internet of Things devices, particularly microcontroller (MCU) class devices.
Some readers were prompted by commentary around the compromise, including Russ Cox's Bluesky post warning that IoT boxes that can't or don't update are now trivially MITM'able forever. Scott Helme's post, which reached the top of Hacker News, issued a similarly strong warning covering cameras, routers, cars, medical devices, payment terminals and industrial controllers, whose bundles are frozen until 2039.
Whether these warnings apply depends on what counts as an IoT device. A single board computer like a Raspberry Pi, or anything running Linux, is likely affected and should be updated quickly through an over-the-air solution. Fleets of MCUs, however, are probably not directly affected. Understanding why requires a basic grasp of public key infrastructure and web PKI.
Devices and browsers ship with bundles of root certificate authority certificates that act as trust anchors. Every HTTPS site presents a certificate chain that traces back to one of these roots, allowing clients to verify identity. Because MCUs typically store only a small, fixed set of roots, they are not exposed in the same way as general-purpose systems.
Source: Hacker News · Summarized by HeadlinesBriefing