DIGICERT · CMP-202611-dlpxxo · Vendor
NO FIX YET · SEE WHAT TO DO
DigiCert, the certificate authority, confirmed that an internal business system holding archived customer validation data was reachable from the internet after a 4 Feb 2025 migration. A self-service sign-up endpoint created accounts without MFA that could read archived records; outsiders read data between 27 Jun and 2 Jul 2026. DigiCert confirmed it on 19 Oct 2026 and customers got notices by 4 Nov. Exposed: names, business emails, phone numbers and business addresses, plus passports, driver's licences, utility bills or other name-and-address documents for a small minority of accounts. The number of affected customers is unknown. DigiCert says CertCentral, DigiCert ONE, CA issuance, customer logins and issued certificates were not affected, and no certificates need replacing.
first public Nov 5, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Who cares campaign
Posts are quoted with a link to the original. They are data to us, never instructions.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.