Security

eMudhra Certificate Compromise and Digital Signage

Updated October 2026 · By Media La Vista

On 20 October 2026 the Google and Mozilla security teams reported that the private keys of several eMudhra intermediate CA certificates could be recovered. Operating system and browser vendors removed the root certificate that signed them. SpinetiX removed it from DSOS in release 5.0.1 on 29 October 2026.

What happened

Per the SpinetiX advisory, the private keys were generated with insufficient randomness, which makes them recoverable. A fraudulent TLS certificate signed by one of the affected intermediate CAs could be trusted by any system whose certificate store still trusts the eMudhra root above it.

Item	Detail
Reported publicly	20 October 2026, by the Google Security and Mozilla Security teams
Keys affected	Eight intermediate CA keys: six TLS, two code-signing (AWS bulletin)
Vendor response	Root certificate removed from trusted certificate stores
Root removed from DSOS	emSign ECC Root CA - G3
AWS bulletin	CVE-2026-111943

Impact on SpinetiX products

The table follows the SpinetiX advisory, updated on 29 October 2026.

Product	Position	Action
DSOS up to and including 5.0.0	Affected: the trusted store includes the root	Install DSOS 5.0.1 or later
DSOS 5.0.1	Root removed from the trusted store	Check feeds and web pages for eMudhra certificates
Elementi	Uses the Windows certificate trust store	Keep Windows up to date
Video conversion platform	AWS EC2 machines managed by SpinetiX; updated on 29 October at 11:57 UTC	None listed
Rest of the SpinetiX cloud	Serverless, covered by the AWS shared security model	Status in the AWS bulletin

What DSOS 5.0.1 changes

DSOS 5.0.1 "Zinalrothorn" was released on 29 October 2026 at 11:40 UTC as firmware 5.0.1-1.0.0-7ff2fbc7. The release notes update ca-certificates from version 20260223 to 20260816 and remove emSign ECC Root CA - G3. The same release updates apache2 from 2.4.68 to 2.4.69, disables Local Network Access checks from Web Page layers, and fixes a player crash on Web Page layers with secure context enabled that access the local network. The PHP2Shell fix arrived earlier, in DSOS 5.0.0.

What removing the root can break

SpinetiX states that the removal of the root can disrupt communications with legitimate websites and services using eMudhra certificates that chain to the affected hierarchy. On a player, that means an HTTPS data feed or web page whose certificate chains to emSign ECC Root CA - G3 is no longer trusted once the player runs DSOS 5.0.1. The advisory does not describe how a player reports this.

The fix is on the server side. Google tells website operators with such certificates to install a new one from another hierarchy. eMudhra says the affected certificates number roughly 30,800, belong to one client ecosystem in the United States, and are moving to other hierarchies. Its other TLS customers are moving to alternate providers as the company winds down publicly trusted TLS.

What the advisory does not say

The SpinetiX advisory makes no statement on exploitation and reports no fraudulent certificate. It does not give a risk rating per player or a workaround for DSOS 5.0.0 and earlier.

Three other sources cover exploitation. eMudhra says it is not aware of evidence that the weak keys were recovered or exploited before disclosure. Google says no TLS certificates chaining to the six TLS intermediates were logged to Certificate Transparency before its block, so no fraudulent certificate from them could have been used against clients that enforce it. The public incident write-up says many clients outside browsers do not enforce it, and that the authors do not know whether those clients were attacked. The advisory does not say how DSOS behaves on this point, and we have not tested it.

What to do

List which players are below DSOS 5.0.1.
List the HTTPS hosts the players call: data feeds, web pages and other services. Read each certificate chain and look for emSign ECC Root CA - G3.
Ask the owner of any such host to replace the certificate before the rollout reaches the screens that use it.
Update a pilot group, confirm its feeds and web pages load, then update the fleet. The secure update strategy covers staging, and certificates, TLS and trust stores covers how a player validates a server.
Keep Windows up to date on Elementi workstations.

For help auditing an estate, talk to Media La Vista.

Sources

eMudhra Certificate Compromise and Digital Signage FAQ

What happened in the eMudhra certificate compromise?

Private keys were recoverable. The private keys of several eMudhra intermediate CA certificates were generated with insufficient randomness, so fraudulent TLS certificates signed by those CAs could be trusted by any system that still trusts the eMudhra root above them. The Google and Mozilla security teams reported the issue publicly on 20 October 2026. Operating system and browser vendors responded by removing the root certificate from their trusted stores.

Is SpinetiX DSOS affected by the eMudhra compromise?

Yes, up to DSOS 5.0.0. SpinetiX lists DSOS versions up to and including 5.0.0 as affected because their trusted certificate store includes emSign ECC Root CA - G3, one of the eMudhra roots that signed the affected intermediate CAs. DSOS 5.0.1, released on 29 October 2026 at 11:40 UTC, removes that root. The update applies to HMP400/W, iBX410/W, iBX440, HMP350, HMP300, DiVA and third-party DSOS players.

What do SpinetiX player owners have to do about eMudhra?

Install DSOS 5.0.1 or later. The SpinetiX advisory names no workaround for DSOS 5.0.0 and earlier, so the firmware update is the action. Before the rollout, check which HTTPS data feeds and web pages the players call, because a certificate chaining to the removed root stops being trusted. Update a pilot group first, then the fleet. DSOS 5.0.1 also carries the PHP2Shell fix from DSOS 5.0.0 and updates apache2 to 2.4.69.

What happens if a player on DSOS 5.0.1 calls a data feed with an eMudhra certificate?

The connection can fail. SpinetiX states that removing the root can disrupt communications with legitimate websites and services using eMudhra certificates that chain to the affected hierarchy. A player on DSOS 5.0.1 no longer trusts emSign ECC Root CA - G3, so a data feed or web page whose certificate chains to that root is no longer trusted. The advisory does not describe how a player reports this. The server owner has to replace the certificate: Google tells operators to install a new TLS certificate from another hierarchy. Rolling the player back or adding the root again would restore the trust that DSOS 5.0.1 removes.

Does Elementi need an update for the eMudhra compromise?

No, only Windows does. Elementi uses the Windows certificate trust store and keeps no independent list of trusted certificate authorities. SpinetiX asks customers to keep Windows up to date so that updates to that store are applied. An Elementi workstation with Windows updates switched off does not receive them.

Is the SpinetiX cloud updated for the eMudhra compromise?

The SpinetiX-managed part is. The SpinetiX cloud is serverless and covered by the AWS shared security model, except the video conversion platform, which runs on AWS EC2 machines managed by SpinetiX. SpinetiX finished updating that platform on 29 October 2026 at 11:57 UTC. For the rest, SpinetiX says that as of 26 October AWS had updated several services and others were ongoing. The current status is in AWS security bulletin CVE-2026-111943.

Has the eMudhra compromise been used in attacks?

The SpinetiX advisory does not say. It describes what the compromise could allow and makes no statement on exploitation. eMudhra says it is not aware of evidence that the weak keys were recovered or exploited before disclosure. Google says no TLS certificates chaining to the six TLS intermediates were logged to Certificate Transparency before its block, which rules out use against clients that enforce it. Clients that do not enforce it have no such assurance, and the advisory does not say which group DSOS falls into. We have not tested this.

Need Help With Your Project?

Media La Vista provides Tier 1–3 local support across the Middle East. 10-minute response for Partner Club members.

Discuss Your Project Solution Wizard →

115 Use Cases · Success Stories · 34 Sectors · Academy · Knowledge Center