JetBrains has announced the availability of critical security updates affecting its software development tool suite and programming environments, including Integrated Development Environments (IDEs), the Toolbox App, Gateway, and .NET tools, following the discovery of a breach involving the private keys of eight intermediate certificates issued by the certificate authority (eMudhra).
Nature of the Security Threat and Impact on Work Environments
This breach poses a potential risk because a network attacker monitoring traffic could impersonate websites and services connected to by JetBrains tools. Since development environments and the Toolbox App rely on the trust store of the embedded JetBrains Runtime (JBR), operating system updates alone are not sufficient to protect users from these risks.
The company has integrated Oracle vulnerability patches to address the issue via a runtime update, alongside providing separate updates for the background service (jetbrainsd), which maintains its own trusted certificate store. While the company confirmed that no actual exploitation of this vulnerability against its users has been detected up to the time of publication, it emphasized the necessity of taking immediate action.
What Changes Practically?
Developers and users must take practical steps to ensure the security of their work environments, which include:
- Updating Integrated Development Environments such as IntelliJ IDEA, PyCharm, Rider, and other tools to the new secure versions.
- Updating the Toolbox App to recent versions and avoiding older versions that will not receive fixes.
- Updating the background service (jetbrainsd) and installing version 0.9.9728 or later for those who encounter difficulty updating applications directly.
- Following workaround steps if immediate updating is not possible, which include manually removing affected root certificates and disabling the embedded browser when necessary.
Support Procedures and Temporary Workarounds
JetBrains clarified that older versions released in 2025 and earlier will not receive updates for this issue, making it imperative for users to transition to supported versions. In cases where direct updating is not feasible, the company provided a guide for manually cleaning the certificate list using Java command-line tools, along with explaining how to disable the embedded JCEF browser to avoid any associated vulnerabilities.