Qlty services are running normally. This is a security issue in certificate trust, not an outage.
We have published a security advisory with the status of each Qlty component and steps you can take now: https://github.com/qltysh/qlty/security/advisories/GHSA-f55x-97q4-pfrc. We will keep the advisory up to date as fixes ship, and we will stop posting updates here.
No components marked as affected
Resolved
Qlty services are running normally. This is a security issue in certificate trust, not an outage.
We have published a security advisory with the status of each Qlty component and steps you can take now: https://github.com/qltysh/qlty/security/advisories/GHSA-f55x-97q4-pfrc. We will keep the advisory up to date as fixes ship, and we will stop posting updates here.
Investigating
We are responding to the recently disclosed eMudhra certificate authority compromise: https://emudhra.we-have-a-problem.com/. An attacker able to intercept network traffic could impersonate trusted services to software that still accepts the affected certificates.
We have released initial mitigations for our hosted analysis infrastructure. We are continuing to review and remediate Qlty services, build environments, the CLI, and bundled tooling, including installation and upgrade paths.
We recommend that CLI and self-hosted CI users apply OS security updates and keep certificate verification enabled. Some developer tools use separate certificate bundles, so an OS or browser update alone may not be enough. We will publish fixed versions, upgrade instructions, and any cache refresh steps when they are available.
