JetBrains says developers should update their IDEs and related tools after the private keys of eight eMudhra intermediate certificates were compromised. A network attacker able to intercept traffic could use the keys to impersonate services the tools connect to, according to Ilya Petrov’s October 30 security notice.
Evidence status: compromised certificate keys and a vendor-described impersonation risk. JetBrains says it was not aware of exploitation against its users at publication. That is not proof no attack occurred.
The operating system update is not enough
JetBrains IDEs use the certificate trust store bundled with JetBrains Runtime. Their embedded browser and the jetbrainsd background service have separate certificate lists. Updating the operating system alone does not repair all three.
JetBrains lists fixed versions for each product and supported release line in its notice. For example, IntelliJ IDEA, PyCharm, WebStorm and GoLand list 2026.2.4 for the 2026.2 line. The Toolbox App lists 3.9.1 and 3.8.2. Check the exact product and release line in the vendor’s table; fixes differ between products.
IDE versions 2025.1 and earlier and Toolbox 3.7 and earlier will not receive this fix. Move to a listed fixed version. If using JetBrains Runtime directly, check the notice’s separate runtime build list.
Check the browser and background service separately
The 2025.2.6.x IDE updates contain the runtime fix but still need a separate embedded-browser hotfix, JetBrains says. Until then, follow its instructions to disable JCEF, the embedded browser. Disabling it can affect previews, notebook output and plugins.
On fixed IDE versions from 2025.3 onward, the browser downloads certificate updates from Google’s update servers shortly after startup. If access to those servers is blocked, JetBrains advises disabling the embedded browser because it remains unprotected.
The background service has its own fix in jetbrainsd 0.9.9728. Starting an updated Toolbox App or IDE that includes it replaces an older service for that user, according to the vendor. JetBrains provides separate installation and version-check instructions when an app update is unavailable.
Check other runtimes too
Project JDKs and tools such as Node.js, Python and Go can carry separate trust stores. Update them using their own vendors’ guidance. JetBrains incorporated Oracle’s Java certificate fixes, including CVE-2026-91403, into its runtime. Its notice also tracks the embedded-browser fix as CVE-2026-118696 and the background service fix as CVE-2026-118697.
The vendor documents temporary manual trust-store changes if an IDE cannot be updated. Those changes do not fix jetbrainsd; follow its separate instructions and prefer a supported update.
Caveat: JetBrains is the affected product vendor and the source for its exposure and fix guidance. Exploitation against its users remained unknown at publication.