Affected Systems
Eight eMudhra intermediate CA certificates (6 TLS, 2 code-signing) under emSign brand. Affects browsers (Chrome, Firefox, Safari), Go 1.26.x/1.27.x, Python certifi, Rust webpki-roots, NSS, and any software using eMudhra-issued certificates. Roots present in Mozilla, Chrome, and Apple trust stores.
Exploitation Status
Private keys confirmed compromised by researcher on October 17, 2026. No evidence of fraudulent certificates logged to Certificate Transparency before browser blocks deployed. Unknown how keys were exfiltrated, when, or if other threat actors possess them. Go patched on URGENT track (reserved for active exploitation or ecosystem integrity threats).
Business Impact
Attackers holding these keys can issue trusted certificates for any domain, enabling man-in-the-middle attacks, phishing, and code signing abuse. Chrome and Firefox pushed revocation blocks within hours; users with auto-updates are protected. Go binaries, Python applications using certifi, and systems relying on static root bundles remain vulnerable until rebuilt or updated. No revocation checking in many non-browser TLS clients means exposure persists until code/bundle updates. Node.js and Composer patches still pending.
Urgency
🔴 Immediate
Recommended Actions
- Update Go to 1.27.3 or 1.26.10 immediately and rebuild all Go binaries that perform TLS verification (CVE-2026-111943)
- Update Python certifi to 2026.10.19 or later, Rust webpki-roots to 1.0.10, NSS to 3.131.1, and Homebrew ca-certificates to 2026-09-25_1
- Verify Firefox 158.0.1 (or ESR 115.43.1/153.5.1) and Chrome auto-updates have deployed; confirm OneCRL/CRLSet blocks are active
- Audit internal applications and appliances using static root bundles or lacking revocation checks; prioritize removal of emSign ECC Root CA - G3 and emSign Root TLS CA - G3
- Monitor Certificate Transparency logs for unexpected certificates chaining to eMudhra roots; watch for Node.js and Composer ca-bundle updates and deploy when available