BackendSource: Weaviate

Weaviate v1.40.2 patches response to eMudhra private-key compromise

Weaviate released v1.40.2 to address compromised private keys for eight eMudhra intermediate CA certificates. The release contains a security patch; upgrading self-hosted 1.40 deployments is an editorial recommendation inferred from that release.

By News DeskPublished here Fri, Oct 23, 2026, 3:24 PM UTC (UTC)1 min read

Cover: BuildRiot

Weaviate released v1.40.2 on October 22, 2026, to address compromised private keys for eight eMudhra intermediate certificate authority (CA) certificates. The release lists one security fix and no new features or breaking changes. Sources: Weaviate, Cloudflare

Cloudflare said the weak private keys could enable forged certificates for arbitrary domains, allowing attackers to impersonate servers and intercept or alter traffic. The Hacker News reported that all eight private-key values were below 256. Six of the affected intermediates were used for Transport Layer Security (TLS), the report said. Sources: The Hacker News, Cloudflare

The v1.40.2 release notes do not identify affected older versions, backports or the precise blocking mechanism. They also provide no explicit self-hosted upgrade instructions or compatibility guidance. Sources: Weaviate

What to do

For self-hosted Weaviate deployments on the 1.40 line, consider upgrading to v1.40.2, the release containing the security patch. This is an editorial recommendation inferred from the release, rather than a documented self-hosted upgrade path. Sources: Weaviate

Why it matters

v1.40.2 contains a security patch addressing compromised private keys for eight eMudhra intermediate CA certificates. The release notes provide no explicit self-hosted upgrade instructions or compatibility guidance.

Attribution

Sources

1WeaviateRelease v1.40.2 - eMudhra intermediate certificates security patchSource published Thu, Oct 22, 2026, 12:00 AM UTC (UTC)
2The Hacker NewseMudhra to Exit Global SSL/TLS Business After 8 Intermediate CA Keys Found Easily GuessableSource published Thu, Oct 22, 2026, 12:00 AM UTC (UTC)
3Cloudflare8 eMudhra certificates are compromised. Here's what you need to know
4WeaviateHow Weaviate responded to the eMudhra certificate compromiseSource published Thu, Oct 22, 2026, 12:00 AM UTC (UTC)

Read the original source for full details and context.

All Backend stories

Backend

Oracle releases 1,295 security patches across Java SE, MySQL and other products

Oracle’s October 20, 2026, Critical Patch Update includes 55 Java SE patches and 98 MySQL patches. Both products have flaws that Oracle says may be exploited remotely without authentication.

OracleOct 21, 2026

Backend

PHP schedules critical security fixes for October 21 at 14:00 UTC

PHP scheduled fixes for two critical vulnerabilities for October 21, 2026, at 14:00 UTC. Deployment teams should inventory runtimes and assign patch owners ahead of the release.

PHPOct 21, 2026

Article · AI

Build a Voxtral 3 booking prototype that checks corrections before committing

Mistral’s Voxtral 3 booking demonstration shows a corrected reference before a lookup. This guide proposes a prototype to test whether corrections also prevent obsolete bookings, with controls for delayed tools, confirmation and database writes.

Mistral AIOct 21, 2026