Eight eMudhra intermediate CA private keys compromised, forcing emergency certificate blocks across browsers and software

Mozilla and Google's Chrome Root Program confirmed that the private keys of eight eMudhra intermediate certificate authorities were compromised, six TLS intermediates and two code-signing, after a researcher reported it on October 17 and proved control by signing messages with each key. A key holder could issue a certificate for any website a browser would accept, though Chrome found no affected TLS certificate logged to Certificate Transparency and reported no confirmed misissuance. Chrome, Mozilla, Apple, and Microsoft blocked the intermediates within days, and Go shipped releases 1.27.3 and 1.26.10 under CVE-2026-111943 that reject any chain containing the keys. Firefox and other projects issued fixes.

Check

Apply browser and OS updates that block the eMudhra intermediates, update Go to 1.27.3 or 1.26.10 and rebuild programs, and patch Firefox and other affected trust stores.

Affected

Systems that still trust the eight compromised eMudhra intermediate certificate authorities could accept attacker-issued certificates for any website, undermining TLS and code-signing trust.

Fix

Install the browser, Go, Firefox, and trust-store updates that block or remove the affected keys, and ensure revocation checking fails closed where possible.