Cryptoupdated 1h ago2 min read
Wayne Identified eMudhra Secret Keys Compromised, Prompting Mozilla and Chrome Blocks
This article is an automated aggregation of coverage from news outlets. Our editorials offer in-depth analysis curated by the NewsCord team.
Eight eMudhra intermediate CA private keys were compromised, enabling forged certificates. Major browsers and platforms blocked all eight certificates after disclosure.
14 outlets told this the same way.
Eight keys, one message
Security researchers and browser makers moved to contain a certificate authority failure after a researcher identified as Wayne reported that eight secret keys at eMudhra were compromised, and he proved control by signing a warning message: "We have a problem here – Wayne."
“Mozilla got the report just on Oct. 17 after 8 p.m. UTC and had a block in place about three hours later.”
Mozilla received the report on Oct. 17 just after 8 p.m. UTC and put a block in place about three hours later, while Chrome blocked the certificates the same day.
eMudhra had issued more than 60 million certificates, and the compromised private keys could let attackers forge authentic-looking certificates for websites and impersonate trusted servers.
Mozilla warned that network interceptors could use fraudulent certificates to impersonate trusted sites, allowing them to read or alter the user's data, even as no crypto attacks or attacks on users had been reported so far.
Revocation blocks, long tail
Mozilla blocked the compromised certificates through Firefox's OneCRL system on October 17, and Google Chrome also blocked six compromised intermediates that day. Apple added protections on October 19, Microsoft’s protection arrived on October 20, and eMudhra revoked the eight compromised intermediate certificates after the disclosure.
Ars Technica said the threat remained far from over because it would be hard and time-consuming to update other key parts of the Internet, including Linux distributions and embedded and Internet of Things devices. Filippo Valsorda told Ars that cleanup would be "a very, very long tail, IoT devices, Docker containers, forgotten Linux machines, unmaintained CLI tools" because many ecosystems ship their own certificate roots.
Go, certifi, and CVE-2026-111943
The Go project released versions 1.27.3 and 1.26.10 to address the issue tracked as CVE-2026-111943, and the change caused crypto/x509 to reject certificate chains that pass through eight intermediate certificates. Pasquale Pillitteri reported that Go’s Verify function "will filter out chains containing these intermediates," so the intermediates are never returned to the caller.
“The Go development team released versions 1.27.3 and 1.26.10 to address the issue, tracked as CVE-2026-111943.”
Cloudflare said it prioritized patching critical services after becoming aware on October 19 at approximately 17:00 UTC, and it reported no active exploitation on Cloudflare services. Mozilla cryptography engineer Dennis Jackson warned that macOS's built-in /usr/bin/curl may continue trusting the compromised certificates because its certificate bundle does not check revocation information, leaving some software stacks exposed until they are updated.