eMudhra intermediate CA compromise
- ID
- 37563
- Status
- summarized
- Published
- 20 Oct 2026, 9:58 PM
- Fetched
- 21 Oct 2026, 2:15 PM
- Provider
- Hacker News
- Category
- dev-community
- Original URL
- https://emudhra.we-have-a-problem.com/
- Source URL
- https://hnrss.org/best
Summary
- Score
- 8.5
- Created
- 21 Oct 2026, 2:16 PM
- Tags
- Audience
- developersvibe_codersai_agent_userssaas_founders
What happened
Eight eMudhra intermediate CA private keys were compromised, and reporter Wayne proved it by signing a message with each key before reporting to root programs on 17 October 2026. Firefox and Chrome blocked the certificates from 17 October and Apple from 19 October, while the CA revoked the intermediates; clients that do not consume revocation data need software updates. The page lists patched CA bundles and runtimes, including Go 1.27.3/1.26.10, curl's 2026-10-20 bundle, Ubuntu 20260816 packages and Arch ca-certificates-mozilla 3.131.1-1, with Debian, FreeBSD and Node.js still pending.
Why it matters
Check your deployed clients against the eight intermediates using the provided curl test hosts, then bump CA bundles where needed: Go 1.27.3 or 1.26.10, curl bundle 2026-10-20, Ubuntu 20260816 packages, Arch ca-certificates-mozilla 3.131.1-1. If you ship Node.js or Debian-based images, both are listed as pending, so those containers may still trust the compromised CAs.
Discussion angle
Walk through the patch matrix live: which production runtimes and base images in your stack are patched, pending, or unknown, and how you would test them with the provided curl endpoints.