Simple Bundles is not affected by the eMudhra certificate compromise (CVE-2026-111943)

Simple Bundles is not affected by the eMudhra certificate authority key compromise (CVE-2026-111943). None of the security certificates that protect Simple Bundles, or the Shopify services it connects to, were issued by eMudhra. There is nothing to patch on our side and no action needed in Simple Bundles.

What happened?

eMudhra is a certificate authority, a company that issues the certificates websites use to prove who they are. In October 2026, researchers found that the private keys for eight eMudhra intermediate certificates could be recovered. Someone holding those keys could create fake certificates. eMudhra revoked the certificates on October 18, and browsers and operating systems, including Chrome, Firefox, Safari and Windows, have released updates that no longer trust them.

Does this affect my Shopify store or Simple Bundles?

No. The Simple Bundles app uses certificates from Let's Encrypt and Google Trust Services. Shopify's own services use the same providers. Simple Bundles connects to your store only through Shopify's official APIs, over those connections.

Do I need to do anything?

No changes are needed in Simple Bundles or your Simple Bundles settings. As general good practice, keep your browser and operating system up to date, because those updates carry the fix that blocks the affected certificates.

What if I use other software that checks certificates?

If your business runs its own servers or software, ask that vendor or your hosting provider whether their certificate lists have been updated. Red Hat's eMudhra bulletin lists the affected certificates and fixed versions.

A security scan flagged Simple Bundles. What should I do?

Contact our support team with the scan report, and our development team will review it.