October 21, 2026 — An urgent security alert warns that compromised digital certificates may have affected the chain of trust browsers use to verify website identities, potentially allowing malicious actors to impersonate legitimate services. Campus community members may see browser security warnings and should not bypass them.
The Information Security Office says it is working with university service providers to identify and promptly replace any affected certificates. Staff are actively monitoring the situation and will take further action as necessary. Because certificate replacements take time to deploy, some services may trigger certificate error screens even when teams are working to resolve the issue.
Security Warnings: What to do
Apply browser and operating system updates immediately. Keep web browsers and your operating system up to date with the latest versions, and restart applications promptly when prompted to install security patches.
Heed security warnings. Never ignore or bypass browser certificate error screens. If a warning appears, stop and contact the service owner or your IT support team before proceeding; the warning may indicate a system awaiting an updated certificate or an active security threat.
Watch for related scams. Be vigilant against phishing attempts or unsolicited offers claiming to “repair” certificate issues. Treat any unexpected requests to download software, install certificates, reveal passwords, share multi-factor authentication (MFA) codes, or grant remote access as fraudulent.
Report suspicious activity. Anyone who suspects their system or credentials were compromised—especially those who previously bypassed a warning, entered CMU credentials, or installed an unverified tool—should contact the Information Security Office.
