Serguey Asael Shinder: JetBrains IDEs need their own eMudhra fix; OS updates do not reach them
The eMudhra key compromise reaches one more Java runtime that a system update does not touch: the one inside every JetBrains IDE. JetBrains published guidance on 30 October telling users to update IntelliJ IDEA, its other IDEs, the Toolbox App, Gateway and ReSharper now. (https://blog.jetbrains.com/security/2026/10/compromised-emudhra-certificates-ides)
The reason is the same one OpenJDK gave for standalone runtimes. The IDEs check server certificates against the trust store of their bundled JetBrains Runtime (JBR), not the operating system's. JetBrains says it integrated Oracle's fixes for CVE-2026-91403 and CVE-2026-114820 into JBR unchanged, so the updated runtime blocks the compromised intermediates and drops four roots: emSign ECC Root CA – G3, emSign Root CA – G1, emSign Root CA – G2 and AAA Certificate Services.
Two other components needed separate work. The embedded browser (JCEF) in 2025.3 and later now pulls Chrome's certificate updates from Google's servers shortly after start-up, tracked as CVE-2026-118696; if the network blocks those servers, the browser stays unprotected and should be turned off. And the background service jetbrainsd has its own built-in certificate list, fixed in jetbrainsd 0.9.9728 (CVE-2026-118697); updating any app that ships that version fixes it for all of them.
For IntelliJ IDEA the fixed versions are 2026.3 RC, 2026.2.4, 2026.1.5.1, 2025.3.6.2 and 2025.2.6.4, with matching builds across the other IDEs; Toolbox needs 3.9.1 or 3.8.2. The 2025.2.6 line contains only the JBR fix for now, with a JCEF hotfix to follow. Versions 2025.1 and earlier, and Toolbox 3.7 and earlier, will not be fixed. For machines that cannot update yet, the post gives a workaround: copy the IDE's cacerts, delete the two affected roots with the bundled keytool, point the IDE at the copy with -Djavax.net.ssl.trustStore, and disable the embedded browser. JetBrains says it knows of no exploitation against its users.
One side effect is worth knowing in advance: an IDE will refuse to connect to a server whose certificate chains to one of the removed roots, and the fix for that belongs to the server's owner.