Get on Slack/Teams RSS
Last updated: November 2, 2026 at 1:20 PM UTC
All 957 Vulnerability 399 Breach 144 Threat 407 Defense 7
Tag: tls (2 articles)Clear
vulnerability
CVE-2026-111943CVE-2026-113470
2026-10-21

Eight eMudhra intermediate CA private keys compromised, forcing emergency certificate blocks across browsers and software

Mozilla and Google's Chrome Root Program confirmed that the private keys of eight eMudhra intermediate certificate authorities were compromised, six TLS intermediates and two code-signing, after a researcher reported it on October 17 and proved control by signing messages with each key. A key holder could issue a certificate for any website a browser would accept, though Chrome found no affected TLS certificate logged to Certificate Transparency and reported no confirmed misissuance. Chrome, Mozilla, Apple, and Microsoft blocked the intermediates within days, and Go shipped releases 1.27.3 and 1.26.10 under CVE-2026-111943 that reject any chain containing the keys. Firefox and other projects issued fixes.

emudhracertificate-authoritytlscode-signingpkigolang
Check
Apply browser and OS updates that block the eMudhra intermediates, update Go to 1.27.3 or 1.26.10 and rebuild programs, and patch Firefox and other affected trust stores.
Affected
Systems that still trust the eight compromised eMudhra intermediate certificate authorities could accept attacker-issued certificates for any website, undermining TLS and code-signing trust.
Fix
Install the browser, Go, Firefox, and trust-store updates that block or remove the affected keys, and ensure revocation checking fails closed where possible.
vulnerability
CVE-2026-15176CVE-2026-93479CVE-2026-97205CVE-2026-97629CVE-2026-95101
2026-10-16

NGINX patches five flaws including possible remote code execution and a TLS client-certificate bypass

F5 released NGINX 1.30.6 and 1.31.7 on October 14 to fix five flaws it rates medium. Three memory bugs, CVE-2026-15176, CVE-2026-93479, and CVE-2026-97205, carry a grouped 9.2 score and could crash a worker process or possibly allow code execution, each requiring a specific configuration. CVE-2026-97629, rated 8.3, is a TLS session ticket key flaw that left a key slot uninitialized after rotation, allowing a forged session that could bypass client-certificate verification on servers using a shared SSL session cache without a defined ticket key. A fifth flaw passes extra HTTP/3 bytes to the backend. None are known to be exploited.

nginxweb-servermemory-corruptiontlsclient-certificate-bypassf5
Check
Upgrade NGINX to 1.30.6 or 1.31.7, and on servers using a shared SSL session cache either define a session ticket key file or disable session tickets.
Affected
Affected NGINX versions carry memory bugs that may allow code execution in specific configurations and a TLS flaw that can forge sessions and bypass client-certificate checks.
Fix
Apply the fixed NGINX builds, add an explicit session ticket key or remove the shared cache directive, and confirm distribution packages have backported the patches.