Reported Oct 23, 20265h ago
Sonatype's Paul Horton creates eMudhra Audit and Fix script
Paul Horton created an open-source script that audits selected developer tools and certificate stores on Unix-like machines using live HTTPS probes and version checks, with optional confirmed remediation actions. The Nexus Community project is not officially supported by Sonatype and checks only specified tools and paths on the local machine, not remote systems or containers.
A Protected Browser Doesn't Mean Your Enterprise Is RemediatedReported Oct 23, 202612h ago
CSIRT Italia identifies residual eMudhra exposure in macOS command-line tools
CSIRT Italia reported that macOS system tools including curl, git, python3, perl, ruby, and openssl use /etc/ssl/cert.pem without checking certificate revocation. Apple had not updated that bundle, leaving these tools exposed to the compromised eMudhra certificate chains even on fully updated systems.
Compromissione di chiavi private associate a certificati CA intermedi eMudhra - ACNReported Oct 22, 202621h ago
Python releases 3.15.1, 3.14.9, and 3.13.17 for eMudhra certificate mitigation
Python released versions 3.15.1, 3.14.9, and 3.13.17 with bundled pip 26.2.2 and certifi 2026.10.19 to address the eMudhra/emSign certificate incident. Maintainers exceptionally provided installers and updated pip for security-only Python 3.13, and advised separately updating pip and uv in existing virtual environments.
oss-sec: Python 3.15.1, 3.14.9 and 3.13.17 are outReported Oct 22, 20261d ago
Mozilla researcher publishes tool to check trust in compromised eMudhra certificates
Mozilla researcher Dennis Jackson published a tool to help users determine whether their systems still trust the compromised eMudhra intermediate certificates. The tool supports identifying systems that may still need software or trust-store updates.
Browsers Revoke Trust in Eight eMudhra Certificates After Private Key Compromise - CySecurity News - Latest Information Security and Hacking IncidentsReported Oct 22, 20261d ago
Lightning Labs urges updates and provides binaries blocking compromised eMudhra keys
Lightning Labs urged immediate software updates and provided new binaries that block trust in compromised eMudhra certificate keys. Updating Go on a host alone does not patch already-installed applications.
Lightning Labs Urges Immediate Updates Over Certificate Vulnerability | The DefiantReported Oct 22, 20261d ago
eMudhra denies infrastructure breach and says weak intermediates issued no certificates
eMudhra said none of the eight affected intermediate CAs had issued end-entity certificates, distinguishing them from the approximately 30,000 certificates requiring migration because of root distrust. The company also denied infrastructure compromise or a data breach and said its physical and logical security controls remained intact.
eMudhra Exits Global SSL/TLS Certificate Business Following the Vulnerability DisclosureReported Oct 22, 20261d ago
InCommon university administrators report eMudhra certificate replacement impact
Reddit administrators reported that universities using Internet2's InCommon service through CertiNext/eMudhra face certificate replacements following root distrust. One administrator reported 30 affected certificates at their institution, with all but two supporting forced renewal through ACME; these claims were not independently verified.
Support to all those university sysadmins renewing eMudhra certs this weekend : r/sysadminOct 22, 20262d ago
LibreSSL 4.4 removes emSign G3 root following eMudhra weak-key compromise
LibreSSL released version 4.4, removing eMudhra's emSign ECC Root CA - G3 after reports of eight intermediate certificates with extremely weak private keys. The release also adds some uncompromised intermediate certificates for interoperability.
LibreSSL 4.4 Released With Faster SHA3, Bug Fixes - PhoronixOct 22, 20262d ago
Red Hat releases RHEL certificate-trust fixes for eMudhra compromise
Red Hat reported fixes for CVE-2026-114406 in RHEL 10 and RHEL 9 through RHSA-2026:88455 and RHSA-2026:88459 on October 22, 2026. RHEL 8 followed on October 23 through RHSA-2026:88550, extending remediation for affected eMudhra certificate trust.
2556046 - (CVE-2026-114406) CVE-2026-114406 ca-certificates: Distrust eMudhra intermediate CA certificates due to security concernsOct 22, 20262d ago
Researcher reports sigstore upgrade may leave affected certificate bundle unchanged
Eli Schwartz reported that sigstore selected a newer certifi in its lockfile but did not impose a minimum certifi dependency, so upgrading sigstore alone would not necessarily refresh certificates in existing installations. He contrasted this with conda, which added a minimum certifi version requirement.
oss-sec: Re: Information for Python users regarding eMudhra / emSign CA certificate security incidentOct 22, 20262d ago
Python notice warns pip retains eMudhra trust despite system certificate blocks
An October 22 oss-sec notice reported that pip versions before 26.2.2 continue trusting the affected eMudhra certificates through vendored certifi even when the operating system distrusts them, and that upgrading pip is the only reliable fix. The guidance also identified conda 26.9.4 or later as a mitigation.
oss-sec: Information for Python users regarding eMudhra / emSign CA certificate security incidentOct 22, 20262d ago
Böck reports retained S/MIME trust for Comodo root in NSS
On October 22, Hanno Böck reported that Comodo AAA Services Root retains email-protection trust in NSS and remains trusted for S/MIME in Thunderbird despite disabled web trust. The compromised eMudhra intermediates' TLS-only extended key usage should prevent S/MIME abuse with correct validation; no application bypass or exploitation was demonstrated.
oss-sec: Comodo AAA Services Root and S/MIMEOct 22, 20262d ago
eMudhra announces exit from global SSL/TLS certificate business
On October 22, 2026, eMudhra announced a board-approved voluntary exit from the global SSL/TLS certificate business following the compromise of eight intermediate CA private keys. The company committed to supporting migration through free partner-provided replacement certificates and maintaining revocation and certificate-status services until issued certificates expire or are replaced.
eMudhra Exits Global SSL/TLS Certificate Business Following the Vulnerability Disclosure | Cryptika CybersecurityOct 22, 20262d ago
Aikido identifies affected eMudhra trust bundles in four container images
As of October 22, Aikido identified grafana/grafana:latest, mysql:latest, jenkins/jenkins:latest and bitnami/postgresql:latest as still carrying affected certificate trust bundles. These images could retain trust in compromised eMudhra certificate chains despite browser-level protections; exploitation was not confirmed.
eMudhra CA Compromise: Eight Weak Private KeysReported Oct 22, 20262d ago
Sonatype demonstrates Java fingerprint-blocklist bypass for eMudhra intermediates
Sonatype Research Labs demonstrated that re-encoding ECDSA- and RSA-signed eMudhra intermediate certificates without their private keys bypassed Java's SHA-256-based blocked.certs checks in tested configurations. Removing the relevant trusted roots caused both test chains to be rejected; the report does not identify the tested JDK versions.
The Limits of Fingerprint Blocklists: A Reproducible Java Certificate BypassReported Oct 21, 20262d ago
Sonatype confirms affected certificate trust stores and begins component updates
Sonatype reported that the eMudhra incident affects certificate trust stores used by certain Sonatype products and distributions and said it is updating affected components. It directed customers to its security event page for product-specific guidance without identifying affected products or versions in the provided content.
eMudhra CA Incident: Sonatype's Assessment and Guidance - Malware News - Malware Analysis, News and IndicatorsReported Oct 21, 20262d ago
Sonatype identifies affected Nexus Repository, IQ Server, and Guide offerings
Sonatype identified affected self-hosted Nexus Repository releases predating October 21, 2026, IQ Server version 208 and earlier, cloud-hosted Nexus Repository and IQ Server, and Sonatype Guide. Updated Docker images and patch releases were still being prepared; existing images and bundled JVMs do not update automatically.
eMudhra CA Incident: Sonatype's Assessment and GuidanceReported Oct 21, 20262d ago
Google announces planned removal of emSign G3 root from Chrome Root Store
Google announced plans to remove emSign ECC Root CA - G3 from the Chrome Root Store across devices on October 27, 2026. Websites chaining to that root must obtain certificates under another trusted root before removal to avoid Chrome trust errors.
eMudhra Certificate Flaw Requires Updates Beyond BrowsersReported Oct 21, 20262d ago
Obol urges immediate Charon upgrade following CA key compromise
Obol urged Charon users to upgrade immediately following a certificate authority key compromise, with the patch updating certificate checks in Go. The available content does not identify the compromised CA, specify a patched Charon version, or report exploitation or loss of funds.
Obol Urges Immediate Charon Upgrade After CA Key Compromise | The DefiantReported Oct 21, 20262d ago
Cisco Talos identifies Snort rules covering compromised eMudhra certificates
Cisco Talos identified Snort rules with SIDs 67363 through 67374 as providing coverage for the threat involving compromised eMudhra intermediate certificates.
Compromised eMudhra intermediate certificatesReported Oct 21, 20262d ago
Cloudflare removes vulnerable eMudhra intermediates and updates WARP
The source reports that Cloudflare removed vulnerable eMudhra intermediate certificates from its edge TLS infrastructure and updated Cloudflare WARP client software. It does not specify the deployment dates or patched WARP versions.
eMudhra Intermediate CA Private Key Compromise: | ShellcodeReported Oct 21, 20262d ago
Debian, Fedora, Electron, pip, and uv receive eMudhra mitigation updates
Debian and Fedora ca-certificates packages, along with Electron, pip, and uv, received updates addressing the compromised eMudhra intermediate certificates. The report does not specify the patched versions or release dates.
eMudhra Intermediate CA Compromise - InfoQReported Oct 21, 20262d ago
Composer ca-bundle fixes available in versions 1.4.16 and 1.6.0
The report identifies PHP composer/ca-bundle versions 1.4.16 and 1.6.0 as containing fixes for the compromised eMudhra certificates, establishing release availability beyond the previously documented code merge. It lists no fix for the 1.5.x release line.
eMudhra CA Compromise: Cloud Security Risks - UpwindReported Oct 21, 20262d ago
Alpine SBOM check flags 70 packages potentially affected by bundled certificate stores
LN Liberda reported that an Alpine Linux edge SBOM check identified 29 community and 41 testing packages potentially affected by the eMudhra certificate compromise. Liberda also identified uv and deno as applications using bundled certificate stores by default and linked an Alpine tracking issue.
oss-sec: Re: Bundled cert stores + eMudhra cert issue (nmap/ncat, texlive-infra)Reported Oct 21, 20262d ago
eMudhra announces internal investigation and review of previous key ceremonies
eMudhra acknowledged multiple human errors and significant key-lifecycle integrity weaknesses, saying it was investigating code flaws, process gaps, and maker/checker controls. It also said it planned to reverify every previous key ceremony over the following week.
Browsers Block eMudhra Intermediate CAs Over Recoverable Private Keys - SecurityWeekReported Oct 21, 20262d ago
Mozilla independently reproduces recovery of compromised eMudhra private keys
Mozilla independently recovered the affected eMudhra intermediate CA private keys without receiving researcher Wayne's recovery method. It concluded that the key-generation process was flawed and straightforward to exploit.
CVE-2026-111943: eMudhra CA Key CompromiseReported Oct 21, 20262d ago
Cycle says private-CA platform is unaffected but customer workloads may remain exposed
Cycle stated that its hosts, private networks, and load balancers communicate with Cycle services using a private CA, leaving its platform layer unaffected by the eMudhra compromise. Customer containers and VMs require independent assessment and remediation because Cycle does not modify their internal trust stores.
eMudhra Intermediate CAs Compromised | Cycle.ioReported Oct 21, 20262d ago
Google reports no pre-block CT records for compromised eMudhra TLS intermediates
Google reported finding no TLS certificates chaining to the six compromised eMudhra TLS intermediates in public Certificate Transparency logs before the intermediates were blocked. This limited exposure for clients enforcing Certificate Transparency, but did not exclude attacks against software without that requirement.
" On a un problème " : une faille de sécurité absurde met Internet en alerte - NumeramaReported Oct 21, 20263d ago
eMudhra halts G3 issuance and estimates 30,000 certificates need migration
eMudhra confirmed that issuance had ceased from all intermediates chaining to emSign ECC Root CA - G3 and estimated approximately 30,000 certificates across that hierarchy require migration. The estimate includes legitimate customer certificates, not certificates known to have been fraudulently issued; eMudhra planned to move subscribers to chains under its G1 root.
eMudhra Estimates 30,000 Certificates Need MigrationReported Oct 21, 20263d ago
Additional eMudhra trust-store fixes available across six software ecosystems
The report identifies Alpine ca-certificates 20261020-r0, Chainguard ca-certificates 20260909-r3, and Homebrew ca-certificates 2026-09-25_1 as remediations for the eMudhra compromise. It also lists the curl CA bundle dated 2026-10-20, Cloudflare CFSSL trust store 2026.10.1, and Elixir castore 1.0.22 as fixes, without establishing their release dates.
Mozilla, Google и Apple блокируют скомпрометированные сертификаты eMudhra - ХакерOct 21, 20263d ago
NetBSD issues eMudhra advisory with fixes for all supported versions
On October 21, 2026, NetBSD published an advisory stating that fixes were available for all supported versions and documenting how NetBSD 10 and later users could distrust emSign ECC Root CA - G3 and Comodo AAA Services root. Users of the non-default pkgsrc mozilla-rootcerts package were advised to update and replace the package, then refresh installed certificates.
NetBSD BlogOct 21, 20263d ago
Chrome questions eMudhra over invalid G1 revocation list and 2025 incident disclosures
On October 21, Chrome posted 12 questions about eMudhra's invalid G1 certificate-revocation-list signature, possible multiple CA key pairs, and customer migration. Chrome also raised transparency concerns after eMudhra disclosed that invalid revocation lists from 2025 had been re-signed using the weak keys subsequently found compromised.
eMudhra to Exit Global SSL/TLS Business After 8 Intermediate CA Keys Found Easily GuessableOct 21, 20263d ago
CERT-In reports no observed malicious use of compromised eMudhra keys
India's computer emergency response team, CERT-In, said it had observed no malicious use of the compromised eMudhra intermediate private keys as of October 21. This assessment did not establish that exploitation had never occurred.
eMudhra kills its certificate business after researchers cracked its private keys in under a second | CyberScoopOct 21, 20263d ago
Red Hat releases grafana-pcp security update for RHEL 9.2 streams
On October 21, 2026, Red Hat issued RHSA-2026:86973, providing grafana-pcp 5.1.1-5.el9_2.3 for specified RHEL 9.2 product streams. The Important-rated update addresses CVE-2026-111943 in Go's crypto/x509 component, involving man-in-the-middle attacks through untrusted intermediate certificates.
RHSA-2026:86973 - Security Advisory - Red Hat Customer PortalOct 21, 20263d ago
Red Hat releases grafana-pcp fix for compromised intermediate certificate trust
On October 21, 2026, Red Hat issued RHSA-2026:86972, providing grafana-pcp 5.1.1-10.el9_4 for specified RHEL 9.4 product streams. The Important-rated update addresses CVE-2026-111943 in Go's crypto/x509 component, which permits man-in-the-middle attacks via untrusted intermediate certificates.
RHSA-2026:86972 - Security Advisory - Red Hat Customer PortalOct 21, 20263d ago
Firefox ESR user reports unexpected trust in Comodo AAA Services Root
Jakub Wilk reported that his Firefox 153 ESR installation still trusted Comodo AAA Services Root, which cross-signed compromised eMudhra intermediates, despite an expected earlier change disabling its web trust. The oss-sec discussion left the discrepancy unresolved and did not establish that Firefox accepted the compromised intermediates.
oss-sec: Re: eMudhra Intermediates CompromiseReported Oct 21, 20263d ago
Red Hat identifies affected RHEL trust stores and expedites eMudhra remediation
Red Hat identified affected certificate trust stores in RHEL 6–10 and potential exposure in dependent products and containers, and said it was expediting updates to distrust the compromised certificates. It advised considering temporary root-CA blocklisting, applying ca-certificates updates as available, and rebuilding containers after base-image updates.
RHSB-2026-012 Certificate compromise - eMudhra (CVE-2026-111943) | Red Hat Customer PortalReported Oct 21, 20263d ago
Chrome Root Program reviews continued trust in remaining eMudhra CA certificates
The Chrome Root Program said it was investigating whether eMudhra's remaining CA certificates should continue to be included in the Chrome Root Store, extending scrutiny beyond the eight compromised intermediates.
Weak Certificates From Indian CA Cause Cascade of UpdatesOct 21, 20263d ago
India's IT ministry opens investigation into eMudhra certificate compromise
India’s Ministry of Electronics and Information Technology announced that it had opened an investigation into the eMudhra certificate compromise involving eight intermediate certificates with trivially recoverable private keys.
Weak Certificates From Indian CA Cause Cascade of UpdatesOct 21, 20263d ago
Böck identifies affected eMudhra trust bundles in TeX Live and ncat
On October 21, Hanno Böck reported that TeX Live and ncat, including Nmap 7.992, bundled the affected Comodo AAA Services root certificate. He said upstream texlive-infra had already removed it, notified Nmap's developer about ncat, and urged distributions to update affected bundles.
oss-sec: Bundled cert stores + eMudhra cert issue (nmap/ncat, texlive-infra)Reported Oct 20, 20263d ago
Scott Helme reports recovering eMudhra private keys valued 4, 56, and 115
Security researcher Scott Helme reported recovering eMudhra intermediate private keys with values 4, 56, and 115 from public certificates on his laptop in less than one second. Other researchers identified five additional values—66, 155, 156, 230, and 237—further documenting the trivially small keys.
Indian certification authority eMudhra’s private keys compromised - one of them was the number ‘4’Reported Oct 20, 20263d ago
Google checks other CA certificates for the same failure mode
Google evaluated other CA certificates within the Chrome Root Store trust boundary and found no additional instances of the failure mode affecting the compromised eMudhra intermediates.
Tech Giants Block eMudhra Certificates Tied to 8 Compromised KeysReported Oct 20, 20263d ago
Ubuntu, Arch Linux, and Gentoo provide CA package updates for eMudhra response
The report identifies Ubuntu ca-certificates 20260816ubuntu0.2*.04.1, Arch Linux ca-certificates-mozilla 3.131.1-1, and Gentoo ca-certificates 20260816.3.125 as updates associated with the eMudhra certificate-trust response. The corrupted text does not reliably establish their rollout timing.
��������� �������� ������ � �������� ������ ��������������� ������ eMudhraReported Oct 20, 20263d ago
Commenter reports recovering eight weak eMudhra intermediate private keys
Reddit commenter encbladexp reported recovering eight affected P-384 private keys whose integer values were below 256, attributing the weakness to flawed original key generation. The commenter said the keys could be recovered almost instantly by enumerating 256 candidates or using baby-step giant-step; the supplied reference does not independently verify these claims.
eMudhra Intermediate CA Compromise : r/sysadminReported Oct 20, 20263d ago
Rust webpki-roots 1.0.10 provides fix for eMudhra certificate compromise
The incident response page listed Rust webpki-roots 1.0.10 as containing a fix for the compromised eMudhra intermediate certificates. This extends mitigation to another certificate-trust ecosystem beyond the previously documented browser, Go, and certifi updates.
eMudhra Certificate Authority Compromise Triggers Emergency Action Across BrowsersReported Oct 20, 20263d ago
Python security notice identifies sigstore and pixi mitigation versions
A Python security notice recommends sigstore 4.5.1 or later and pixi 0.82.1 or later to address the eMudhra certificate compromise, alongside certifi, pip, and uv upgrades. It also warns that existing virtual environments and python.org macOS installations may retain affected certificate bundles and require updates.
Information for Python users regarding eMudhra / emSign CA certificate security incident - Packaging / Announcements - Discussions on Python.orgReported Oct 20, 20263d ago
Mozilla announces NSS trust-store update removing the issuing root
Mozilla announced an NSS 3.131.1 trusted certificate list update removing the root certificate that signed the affected eMudhra intermediates. The change is intended to protect applications using Mozilla's trust store or derivatives that do not receive OneCRL updates.
Protecting Firefox users following the compromise of eMudhra intermediate certificates - Mozilla Security BlogReported Oct 20, 20263d ago
Mozilla discloses key compromise and announces additional Firefox protection
Mozilla publicly identified the compromise of eight eMudhra intermediate-certificate private keys and announced Firefox 158.0.1, ESR 115.43.1, and ESR 153.5.1. These updates target users whose custom settings may have prevented delivery of the OneCRL protection.
Protecting Firefox users following the compromise of eMudhra intermediate certificates - Mozilla Security BlogReported Oct 20, 20263d ago
Commenter links Go's blocked key hashes to eMudhra intermediates
A commenter on the Go issue matched all eight blocked hashes to six eMudhra TLS intermediates and two code-signing intermediates using certificate records. The Hacker News did not independently verify the matches, and Go had not named the certificate authority.
Go Issues Emergency Update Blocking Eight CA Keys Over Undisclosed Security ConcernsOct 20, 20264d ago
Microsoft Edge on Windows 10 reportedly connects to 12 vulnerable hosts
The reference cites Ars Technica reporting that Microsoft Edge on Windows 10 connected to 12 hosts vulnerable to the compromised eMudhra certificate chains on October 20. This indicates residual exposure despite Microsoft's reported trust-update deployment that day.
eMudhra CA Key Failure Is a Q-Day Rehearsal for Web PKIOct 20, 20264d ago
Let's Encrypt adds checks rejecting trivially weak ECDSA keys
Let's Encrypt added checks rejecting ECDSA keys whose private values are 255 or less, including their negatives modulo the curve order. Its key-ceremony tool uses these checks to detect this class of weak keys.
Key Ceremony Best Practices and What PQC ChangesOct 20, 20264d ago
Red Hat documents RHEL fixes for Go certificate-trust vulnerability
On October 20, Red Hat documented fixes for CVE-2026-111943 in RHEL 8, 9, and 10 through RHSA-2026:86203, RHSA-2026:86196, and RHSA-2026:86093. Additional advisories on October 21 covered extended-support and specialized RHEL variants, extending the Go certificate-chain mitigation to those packages.
2556068 - (CVE-2026-111943) CVE-2026-111943 crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificatesOct 20, 20264d ago
Rustup 1.29.2 released with fixes for compromised eMudhra certificates
The Rustup Team released rustup 1.29.2, updating rustls-webpki and webpki-root-certs to address compromised eMudhra intermediate certificates associated with CVE-2026-111943. Existing users can obtain the release through rustup self-update or the automatic self-update performed after a normal toolchain update.
Announcing rustup 1.29.2 | Rust BlogOct 20, 20264d ago
CPAN Security Group issues Mozilla::CA advisory for compromised emSign trust
Stig Palmquist posted CPAN Security Group advisory CVE-2026-113812, warning that Mozilla::CA versions before 20261020 trust a root linked to intermediates with publicly available private keys. The advisory recommends upgrading to Mozilla-CA 20261020 or later and verifying which CA store Perl clients actually use, since they may instead rely on system certificates.
oss-sec: CVE-2026-113812: Mozilla::CA versions before 20261020 for Perl provide a CA certificate bundle containing a root linked to compromised intermediatesOct 20, 20264d ago
Gentoo's updated CA package reported to retain two problematic emSign roots
Allen Webb reported that Gentoo ca-certificates 20260816.3.125 still contained emSign ECC Root CA - C3 and emSign Root CA - C1, both removed by NSS 3.131.1. The finding contradicted the initial assessment that only one affected root was present; the discussion showed no subsequent package update resolving the gap.
984601 - (CVE-2026-111943) <app-misc/ca-certificates-20260816.3.125: compromise of intermediates issued by emSign_ECC_Root_CA_-_G3.pemOct 20, 20264d ago
Node.js merges NSS trust-store update removing three emSign roots
On October 20, 2026, Node.js merged pull request #66877, updating its bundled root certificates to NSS 3.131.1. The update removes emSign ECC Root CA - G3, emSign Root CA - C1, and emSign ECC Root CA - C3, complementing its separate compromised-intermediate public-key blocklist.
crypto: update root certificates to NSS 3.131.1 by aduh95 · Pull Request #66877 · nodejs/nodeOct 20, 20264d ago
Node.js merges TLS blocklist for eight compromised eMudhra public keys
Node.js merged a certificate-verification change that checks verified chains against eight compromised eMudhra/emSign public keys and reports matches as certificate-revocation errors. The reference does not establish an available release containing the fix; previously established sessions are not reverified on resumption.
tls: reject chains containing blocked public keys by UlisesGascon · Pull Request #66871 · nodejs/nodeOct 20, 20264d ago
RustSec issues webpki-roots advisory for compromised emSign certificate trust
RustSec issued RUSTSEC-2026-0381 (CVE-2026-111943), warning that webpki-roots could accept certificate paths containing distrusted emSign intermediate public keys whose private keys are publicly known. Version 1.0.10 and later address the vulnerability by removing the emSign ECC Root CA - G3 trust anchor.
RUSTSEC-2026-0381: webpki-roots: Bundled root certificates allow trust in distrusted emSign intermediates › RustSec Advisory DatabaseOct 20, 20264d ago
Composer ca-bundle merges detection of compromised eMudhra intermediates
Jordi Boggiano merged changes into composer/ca-bundle's 1.4 branch adding CaBundle::findDistrustedCertificate(array $chain) to detect compromised eMudhra intermediate certificates, with input-validation and DER-parsing safeguards. The reference does not establish a released version or deployment; a linked Composer change to reject affected TLS connections remained a draft.
Distrust compromised eMudhra intermediates by Seldaek · Pull Request #154 · composer/ca-bundleOct 20, 20264d ago
RustSec issues rustls-webpki advisory with fixes blocking compromised emSign keys
RustSec issued RUSTSEC-2026-0382 (CVE-2026-111943), warning that rustls-webpki could accept certificate paths containing distrusted emSign intermediate public keys when configured trust anchors permit them. Patched versions 0.103.16 and 0.104.0-alpha.8 reject paths containing those keys.
RUSTSEC-2026-0382: rustls-webpki: Certificate verification may accept distrusted intermediates › RustSec Advisory DatabaseOct 20, 20264d ago
oss-sec reports Mozilla's eMudhra tracking issue is publicly accessible
On October 20, Alan Coopersmith reported that Mozilla had removed access restrictions from Bugzilla issue 2083449 concerning the eMudhra intermediate compromise. The message provided no additional technical or remediation details.
oss-sec: Re: eMudhra Intermediates CompromiseOct 20, 20264d ago
RustSec issues advisory for emSign trust flaw in webpki-root-certs
RustSec issued RUSTSEC-2026-0383 (CVE-2026-111943), warning that webpki-root-certs could accept certificate paths containing compromised emSign intermediate keys. Version 1.0.10 and later address the vulnerability by removing the emSign ECC Root CA - G3 trust anchor.
RUSTSEC-2026-0383: webpki-root-certs: Bundled root certificates allow trust in distrusted emSign intermediates › RustSec Advisory DatabaseOct 20, 20264d ago
Certifi announces critical security update removing emSign roots
Seth Larson announced critical advisory GHSA-6q48-6c7w-9gw2 for certifi, identifying version 2026.10.19 as removing emSign roots after associated intermediate certificates were revoked due to key compromise. The announcement urged users to upgrade and rebuild container images to refresh their CA certificate stores.
oss-sec: [oss-security][GHSA-6q48-6c7w-9gw2] CRITICAL security update for certifi, removal of emSign root certificateOct 20, 20264d ago
oss-sec reports verifiable eMudhra signatures and root-store mitigations
An October 20 oss-sec discussion reported a downloadable archive of signatures generated with compromised eMudhra intermediate keys that reportedly verify using OpenSSL. It described disabling the "emSign ECC Root CA - G3" and "Comodo AAA Services root" trust anchors on systems lacking revocation updates, warning of collateral disruption.
oss-sec: Re: eMudhra Intermediates CompromiseOct 20, 20264d ago
Researcher demonstrates unauthorized certificate for q3k.google.com
A demonstration server associated with security researcher “q3k” presented an unauthorized TLS certificate for q3k.google.com, indicating apparent possession of at least one compromised eMudhra intermediate private key. Firefox, Safari, and Chrome rejected the demonstration certificate, while clients using separate trust stores could still require mitigation.
Acht Zertifikate gesperrt: Sicherheitsvorfall bei Zertifizierungsstelle eMudhra | heise onlineOct 20, 20264d ago
Projects rebuild applications with patched Go releases
Projects including Bluesky's indigo rebuilt using the patched Go releases. Application rebuilds are necessary to receive the protection because Go's certificate verifier does not consume browser certificate blocklists.
Go Issues Emergency Update Blocking Eight CA Keys Over Undisclosed Security ConcernsOct 20, 20264d ago
Go releases emergency updates blocking eight intermediate CA public keys
Go released versions 1.27.3 and 1.26.10 through its URGENT security track and recommended immediate upgrades. The mandatory filter rejects chains containing any of eight public keys, including cross-signed certificates and chains verified through operating-system or custom-root configurations.
Go Issues Emergency Update Blocking Eight CA Keys Over Undisclosed Security ConcernsReported Oct 19, 20265d ago
Node.js patched releases become available for compromised eMudhra certificates
The report identifies Node.js 22.23.4 and 22.23.1 as patched releases addressing the compromised eMudhra intermediate certificates. This establishes release availability beyond the previously documented certificate-verification code merge.
eMudhra CA Compromise: Weak Keys and Forged Certificates | TrendAI (US)Oct 19, 20265d ago
Google Play Services deploys eMudhra certificate protection to Android and Googlebooks
Around 22:00 UTC on October 19, 2026, Google deployed protection equivalent to Chrome's compromised eMudhra key block to Android devices and Googlebooks through Google Play Services. Google reported that most Android devices had received the update and that users could trigger an immediate update by restarting.
Protecting Chrome and Android Users from Compromised eMudhra Intermediate CA CertificatesOct 19, 20265d ago
Apple and Microsoft deploy protections against compromised eMudhra certificates
Apple deployed protection against the compromised eMudhra intermediate certificates on October 19, 2026, followed by Microsoft on October 20. These deployments extended mitigation beyond the previously reported Chrome and Firefox certificate blocks.
eMudhra Security Compromise Exposes 8 Certificate Keys That Can Be Cracked in Seconds | Cryptika CybersecurityOct 18, 20266d ago
eMudhra and Sectigo revoke compromised intermediate certificates
eMudhra revoked the affected intermediate certificates on October 18, 2026, and Sectigo revoked its cross-signed versions on October 19. Clients without reliable, current, fail-closed revocation checking could still trust certificates issued using the compromised keys.
2083449 - Private key compromise of eMudhra Intermediate CertificatesOct 17, 20267d ago
Mozilla distributes emergency certificate blocks through OneCRL
Mozilla blocked affected eMudhra intermediate certificates through OneCRL and completed distribution to standard-configured Firefox installations by 22:59 UTC. The protection required neither a browser update nor a restart.
Go Issues Emergency Update Blocking Eight CA Keys Over Undisclosed Security ConcernsOct 17, 20267d ago
Mozilla receives report of eight compromised eMudhra intermediate keys
Mozilla received a report at 20:06 UTC that private keys associated with eight eMudhra intermediate certificates had been compromised. The keys could enable fraudulent HTTPS certificates, allowing attackers who intercept connections to impersonate websites.
Protecting Firefox users following the compromise of eMudhra intermediate certificates - Mozilla Security BlogOct 17, 20267d ago
Chrome blocks six compromised eMudhra TLS intermediates through CRLSet
Chrome received the compromise report at 18:05 UTC and deployed a CRLSet blocking the six affected TLS intermediates by 19:45 UTC after verifying the findings. The public-key-based block also covered Sectigo cross-signed copies and required neither a browser update nor a restart.
Eight eMudhra CA Keys Compromised, Triggering Emergency Fixes Across Browsers and SoftwareMay 2025
eMudhra revokes A-series intermediates and replaces them with A-1 series
Mozilla's preliminary investigation reported that the A-series intermediates from eMudhra's April 30, 2025 batch were revoked and replaced by the A-1 series in May 2025. The eight compromised P384 keys belonged to the separate B and C series; Dennis Jackson reported no successful recovery of A or A-1 P384 private keys.
oss-sec: Re: eMudhra Intermediates CompromiseApr 2025
eMudhra script error generates weak intermediate CA keys
According to eMudhra's account, an April 2025 script error generated a second set of P-384 keys with values below 256. These weak keys were mistakenly selected for intermediate-certificate signing because their labels resembled those of properly generated keys.
Mozilla, Google, Apple block compromised eMudhra CA certificates
