eMudhra CA cert compromise - Security

Several CA certificates were recently compromised. See https://emudhra.we-have-a-problem.com/ for the details.

This is not an exe.dev-specific problem.

This is a significant security risk for all software that uses the Internet, including services built on exe.dev VMs.

We strongly recommend that all exe.dev customers:

Run ssh exe.dev remediate-emudhra-compromise

This will upgrade all the default software that ships with exe.dev VMs, on all of your VMs. It will report back about any VMs that could not be upgraded, typically VMs started with custom images.

It is slow to run. If it is interrupted, it is safe to run multiple times.

No SSH client? Run remediate-emudhra-compromise in the browser shell at https://exe.dev/shell.

If you prefer more control, run ssh exe.dev help remediate-emudhra-compromise. This will print the recommended commands to be run on each VM.

The opencode and pi coding agents bundle their own trusted certs and have not released updates. The command will report about them until upstream fixes ship.

On each VM, ask Shelley or your favorite coding agent to remediate all the non-stock software running on your VM.

Suggested prompt:

Please ensure that all custom software running on this VM is not vulnerable to the CA cert compromise detailed at https://emudhra.we-have-a-problem.com/.

Restart your VMs.

Most programs load trusted certs once, at startup. Restarting your VM ensures that all software is working with the correct certs.

If you don't want to restart the VM, carefully restart all potentially affected software.