October 2026 Security Updates #3 for XCP-ng 8.3 LTS

Security Oct 22, 2026

New security updates are available for XCP-ng 8.3 LTS.

💡

📔 To update, follow this guide. You can also join the discussion on our community forum.

📋Summary

The ca-certificates package shipped with XCP-ng 8.3 includes two eMudhra intermediate CA certificates whose private keys have been compromised. The updated package no longer includes the compromised certificates in the trust store.

We recommend updating as soon as your schedule permits.

🔒Security Updates

ca-certificates

VSA-2026-050: eMudhra Intermediate CA Compromise: Mozilla announced that the private keys of eight eMudhra intermediate certificates have been compromised. XCP-ng 8.3 ships ca-certificates-2021.2.50-73.1.xcpng8.3, which trusts these intermediate certificates in the system trust store. An adversary in a man-in-the-middle position could use them to impersonate websites and read or modify traffic. The new version of ca-certificates-2021.2.50-73.2.xcpng8.3 removes the compromised certificates.