What Happened
The Hacker News reports Mozilla and the Chrome Root Program confirmed on October 20 the private keys of eight eMudhra intermediate CA certificates were compromised. Six are TLS intermediates and two sign code. A researcher reported the problem on October 17. Chrome had a CRLSet block in place by 19:45 UTC, and Firefox finished its OneCRL block at 22:59 UTC. Apple blocked the certificates on October 19 and Microsoft followed on October 20. Go 1.27.3 and 1.26.10 reject chains through the keys under CVE-2026-111943. Nobody has explained how the keys left eMudhra.
Why This Matters for Canadian Organizations
A holder of an intermediate CA key is able to issue certificates for any site. Browsers receive the block automatically, so desktop users need no action. Your servers are different. Go services, containers, and embedded trust stores keep trusting these chains until someone rebuilds or updates them. Software without revocation checking is the most exposed.
A forged certificate allows traffic interception, which defeats the encryption safeguards PIPEDA expects around personal information. Go 1.25 and older receive no fix, and Node.js and Composer had no release when The Hacker News published.
What to Do
Rebuild Go applications with 1.27.3 or 1.26.10 and retire Go 1.25 and older. Update Python certifi to 2026.10.19, Rust webpki-roots to 1.0.10, and Homebrew ca-certificates. Watch for Node.js and Composer fixes. Inventory the trust stores in your container images and appliances, and block the eight intermediates where your tooling allows. Test before removing any root, since removal makes legitimate servers unreachable for some clients. Read more in our TechTalk coverage and our News archive.
