Security update: How Controla is responding to the eMudhra certificate incident

On October 20, 2026, a security issue involving eight digital certificates issued by eMudhra was publicly disclosed. eMudhra is a provider of digital certificates that help establish trust between websites, applications, and online services.

The issue could potentially allow attackers to impersonate trusted services, putting the security of online communications at risk.

While the risk to Controla users is considered low, we’re taking the issue seriously and have reviewed how our services could be affected.

What we’re doing about it

Following the disclosure, we investigated how the Controla app could be affected and took steps to address the issue.

We’ve released an update to the Controla app across all supported platforms to ensure it no longer trusts the affected certificates. Most installations update automatically, and we’re contacting customers who need to update manually.

We’ve also updated our servers and are working on the remaining fixes as they become available.

We’ll continue to monitor the situation closely and take further action if needed.

What you need to do

When it comes to the Controla app, you don’t need to do anything unless you’re directly contacted.

You can always find the latest version of the Controla app on our download page. We’ll update this post if there’s any new information relevant to Controla users.

Further reading

• The internet goes on high alert after discovery of 8 compromised TLS certs – Ars Technica’s overview of what happened
• Indian certification authority eMudhra’s private keys compromised – The Register’s report on how the keys were compromised
• Protecting Chrome and Android users from compromised eMudhra certificates – Google’s response for Chrome and Android
• Cloudflare’s security disclosure – how Cloudflare responded to the incident
• eMudhra Intermediate CA Compromise – technical summary of the incident
• Mozilla’s incident report – the technical discussion between browser makers and eMudhra