LucidLink incident
Security Advisory: Third-party security vulnerability and LucidLink update
Ongoing since 05:17 PM UTC, affecting LucidLink (North America) and LucidLink (Latin America) and 1 more.
What happened This week, security researchers disclosed that eight certificates issued by eMudhra, a third-party certificate authority (CA), were created with weak cryptographic keys. eMudhra has revoked them, and Google, Mozilla, and Apple have removed trust in them. Like other software that bundles its own list of trusted CAs, the LucidLink desktop client needs an update. LucidLink’s servers and infrastructure are not affected. How it relates to LucidLink The LucidLink desktop client includes its own list of trusted certificate authorities. In theory, an attacker positioned on your network connection who had forged one of these certificates could attempt to impersonate a server to an out-of-date client. We have seen no indication that it has been attempted against LucidLink or our customers. What are we doing LucidLink is actively working to remove the affected third-party certificates from both LucidLink 2.x / Classic and LucidLink 3.x. We will release updated desktop clients as soon as our test process is complete, likely this weekend. What’s next We appreciate your partnership and we are committed to maintaining your trust. Please look out for a follow up email as our team works to deliver this patch asap. As always, you have access to the LucidLink status page and our support team if you need additional assistance. We will be back in touch shortly when fixes are available. Sincerely, Gregory Tomczyk VP of Security
Affected components
Update timeline
- monitoring Oct 23, 2026, 05:17 PM UTC
What happened This week, security researchers disclosed that eight certificates issued by eMudhra, a third-party certificate authority (CA), were created with weak cryptographic keys. eMudhra has revoked them, and Google, Mozilla, and Apple have removed trust in them. Like other software that bundles its own list of trusted CAs, the LucidLink desktop client needs an update. LucidLink’s servers and infrastructure are not affected. How it relates to LucidLink The LucidLink desktop client includes its own list of trusted certificate authorities. In theory, an attacker positioned on your network connection who had forged one of these certificates could attempt to impersonate a server to an out-of-date client. We have seen no indication that it has been attempted against LucidLink or our customers. What are we doing LucidLink is actively working to remove the affected third-party certificates from both LucidLink 2.x / Classic and LucidLink 3.x. We will release updated desktop clients as soon as our test process is complete, likely this weekend. What’s next We appreciate your partnership and we are committed to maintaining your trust. Please look out for a follow up email as our team works to deliver this patch asap. As always, you have access to the LucidLink status page and our support team if you need additional assistance. We will be back in touch shortly when fixes are available. Sincerely, Gregory Tomczyk VP of Security
Your product runs on more than LucidLink
Add the vendors you depend on and get one message when any of them reports trouble. Free for 3 vendors, no card.
Amazon Web Services