HN

Need help?
<- Back
CVE-2026-111943: Compromised Intermediate Certificate Authority

CVE-2026-111943: Compromised Intermediate Certificate Authority

keks24

Comments (97)

  • keks24
    Gentoo Linux users are adviced to update the package "app-misc/ca-certificates" to version "20260816.3.125" or higher!: # emerge --sync # emerge --ask --oneshot --verbose ">=app-misc/ca-certificates-20260816.3.125" To check via "curl": $ curl --url="https://dv-g3b-emudhra.we-have-a-problem.com/" $ curl --url="https://dv-g3b-aaa-emudhra.we-have-a-problem.com/" They should return: curl: (60) SSL certificate OpenSSL verify result: unable to get local issuer certificate (20) More details here: https://curl.se/docs/sslcerts.html curl failed to verify the legitimacy of the server and therefore could not establish a secure connection to it. To learn more about this situation and how to fix it, please visit the webpage mentioned above. ---* GLSA 202610-01: https://security.gentoo.org/glsa/202610-01* https://emudhra.we-have-a-problem.com/
  • pelzatessa
    Worth noting that people on RedHat still haven't received proper updates, only a workaround that disables two Comodo root certificates that were used to sign the emudhra certificates.https://access.redhat.com/security/vulnerabilities/RHSB-2026... - "Ongoing"
  • vanschelven
    Python users may need to take their own separate steps, see this discussion:https://discuss.python.org/t/information-for-python-users-re...
  • freakynit
  • asqueella
    This seems to be about ‘go’ proactively blocking emudhra certs even though the system trust store is out of date? https://pkg.go.dev/vuln/GO-2026-6809
  • darkwater
    This is news for NIST but old news generally speaking, being the eMudhra debacle. Or am I missing something?
  • memonkey
    Is there an RSS feed that reports these kinds of vulnerabilities?
  • mort96
    What's this link doing here? This page is about the Go update which rejects the bad certificates if they exist in the system trust store
  • galadran
  • vanschelven
  • stikit
    TL;DRCertificate authority (eMudhra) generated eight of its intermediate signing keys so badly that anyone can recover the private keys from the public certificates. That means anyone can mint a "valid" HTTPS certificate for any site, such as your bank, GitHub, or PyPI, and impersonate it.Much better explanation herehttps://cycle.io/blog/2026-intermediate-ca-compromiseThis is the Go version of the initial HN post https://news.ycombinator.com/item?id=50166579
  • imeron
    It's down for me, are they on PHP? :D
  • charlieyu1
    We are in the era of 6 digit CVE now
  • brazukadev
    My biggest worry now is what's going to happen with the amount of unemployed software developers seeing these vulnerabilities and not able to bring money to pay the bills.
  • zkmon
    Great. The technology has progressed enough to kill the existing technologies. It's like the fish in a pool creating a shark that eats away all the fish while the fish proudly announce that their great creation (shark) as the frontier progress for their fish race.
  • accountrequired
  • alt227
    Im guessing this only affects Go? But I am guessing that from the nist page as none of the headlines mention it at all.
  • jmclnx
    Slackware also updated ca-certificates yesterday (Wed Oct 21 00:53:24 UTC 2026). The curl commands keks24 mentioned fails as expectedhttps://ftp.osuosl.org/pub/slackware/slackware64-15.0/Change...To check, from keks24: % curl --url="https://dv-g3b-emudhra.we-have-a-problem.com/" % curl --url="https://dv-g3b-aaa-emudhra.we-have-a-problem.com/"
  • dathinab
    It's a bit surprising that this took ~1.5days to end up on HN.
  • contingencies
    Fix for OSX - put this in ~/.zshrc: export CURL_CA_BUNDLE="$(brew --prefix)/etc/ca-certificates/cert.pem" To verify, log in to a new shell and run curl https://dv-g3b-emudhra.we-have-a-problem.com/
  • colinmarc
    TL;DR:The very urgent uv/certifi/etc releases (and yet-to-be-done bun release) are about removing the compromised CAs as described here:https://emudhra.we-have-a-problem.com/In other words, that software bundled the compromised certs into the binary, so upgrading it is the only way to remove them.This is about Go proactively blocking intermediates. Which shouldn't strictly be necessary as long as your OS has removed or distrusted the CAs (on my laptop, macOS has done that, although it seems like it did so in a way not all tools have access to; for example, rustls-platform-verifier respects it, but rustls-webpki still loads the bad CAs from the system trust store).edit: forgot I can't use code blocks on HN
  • couldbe
    Literally xkcd random number. https://xkcd.com/221
  • speedgoose
    Cock-up or conspiracy?
  • ritiksanfy
    [flagged]
  • fr2029r
    [dead]
  • anon
    undefined
  • anon
    undefined