This is an important security update for LightWave Client (LWC).
Summary
On October 20, 2026, Mozilla announced an update involving compromised eMudhra intermediate CA private keys. These compromised keys could allow attackers to issue fraudulent certificates for arbitrary hostnames. If an attacker can intercept or redirect HTTPS traffic from LightWave Client, they could potentially impersonate a destination service, exposing credentials and application data or modifying responses.
CAROOT, which contains the trusted CA information used by LightWave Client to establish secure HTTPS connections, is normally updated with each software release. However, urgent security issues may require updates sooner.
What to Do Now
NuWave updated the CAROOT file on October 21, 2026, to address this issue. All current LightWave Client customers should download and install the latest CAROOT file as soon as possible.
The updated file is available as a standalone download, so you do not need to wait for a future LightWave Client release to apply this update.
Download and installation resources:
For more information about the security issue, you can also review the following resources:
Please ensure that the updated CAROOT file is installed across all your LightWave Client instances.
Who Is Affected?
This update applies only to LightWave Client customers. LightWave Server customers are not affected.
Future LightWave Client releases will include the updated CAROOT file.
If you have questions or need assistance with the update, please contact the NuWave Technologies team.