You update your operating system on schedule and think you are clean. For a JetBrains IDE that does not hold. It checks certificates against the list in its own bundled runtime, the JetBrains Runtime (JBR), and a system update never touches it. So on 30 October 2026 JetBrains shipped fixes for its IDEs, for Toolbox App, for Gateway and for ReSharper.
Fact
The facts: according to JetBrains, the private keys of eight eMudhra intermediate certificates were compromised, and a network attacker could use them to impersonate websites and services that its tools connect to. JetBrains IDEs, Toolbox App, Gateway and ReSharper are affected because they use the trust store of the bundled JBR. For IDEs the embedded browser (JCEF) is affected too. The updated JBR blocks the compromised certificates and no longer trusts the roots emSign ECC Root CA - G3, emSign Root CA - G1, emSign Root CA - G2 and AAA Certificate Services. The background service jetbrainsd, used by Toolbox App and the IDEs, has its own built-in list of trusted certificates and is fixed separately in jetbrainsd 0.9.9728, tracked as CVE-2026-118697. JetBrains writes that at the time of publishing it is not aware of any exploitation of the issue against JetBrains users. IDE versions 2025.1 and earlier and Toolbox App 3.7 and earlier will not receive the fix.
The second half is easy to miss. Only one jetbrainsd runs per user, and a newer version always replaces an older one. Update any JetBrains app that includes jetbrainsd 0.9.9728 and the service is fixed for all of them. The JBR fix does not touch it, though, because its list is built into the service itself.
Updating the system does not protect the IDE. It keeps its own list of trusted certificates.
The versions: for IntelliJ IDEA the fix is in 2026.2.4, 2026.1.5.1, 2025.3.6.2 and 2025.2.6.4, and in 2026.3 RC. For Toolbox App look for 3.9.1 or 3.8.2. For Gateway they are 2026.2.4, 2026.1.4, 2025.3.3 and 2025.2.6. The other products have their own numbers in the JetBrains bulletin. Updating to the latest fixed version of your current line is enough.
Two caveats. The 2025.2.6.* updates contain only the JBR fix and will get a separate hotfix for JCEF. Until then JetBrains advises turning JCEF off in your IDE. In the fixed versions from 2025.3 onward the embedded browser receives Chrome's certificate updates from Google's servers shortly after startup. If your network blocks those servers, the browser stays unprotected and you turn it off anyway. In rare cases the IDE will no longer connect to a server whose certificate chains to one of the removed roots. The server's owner then has to replace the certificate. A project's JDK and tools with their own runtime, such as Node.js, Python or Go, keep their own trust stores and are updated as their vendors recommend.
Open Toolbox App and check the version. If it is 3.7 or earlier, there is no fix and updating is the only way.
Official primary sources
JetBrains - Compromised eMudhra Certificates: Update Your JetBrains IDEs, ReSharper, .NET Tools, Toolbox App, and Gateway Now (CVE-2026-118697), 30.10.2026Cloudflare - 4 real? Tracking exploitation and patching of eMudhra's weak keys, 30.10.2026The visual is generated code-art, no third-party images.