EmSign Root CA - G1 - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/emsign-root-ca---g1/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioWed, 21 Oct 2026 14:19:28 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgeMudhra Intermediate Certificate Authority Compromise (CVE-2026-111943)https://feed.craftedsignal.io/briefs/2026-10-emudhra-intermediate-ca-compromise/Wed, 21 Oct 2026 14:19:28 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-10-emudhra-intermediate-ca-compromise/The compromise of eight eMudhra intermediate certificate authority private keys due to a flawed key-generation process allows for the issuance of fraudulent, trusted certificates, necessitating urgent patches across programming language runtimes and browsers.On October 17, 2026, a security researcher identified that eight intermediate certificate authorities operated by eMudhra possessed insecurely generated private keys, which could be independently recovered. This compromise allows an attacker to issue fraudulent, trusted TLS and code-signing certificates. While there is no evidence of widespread abuse prior to defensive actions, the severity of the cryptographic failure prompted immediate revocation and denylisting efforts across browsers and language runtimes. The Go Project released CVE-2026-111943 to hardcode a denylist of the affected keys in the crypto/x509 library to protect applications that do not rely on system-level certificate revocation mechanisms.

Impact

An attacker in possession of the compromised intermediate keys could potentially impersonate legitimate websites, intercept encrypted traffic, or sign malicious code. The risk is highest for applications that manage independent certificate bundles or runtimes that do not consume browser-based revocation lists like CRLSet or OneCRL.

Recommendation

  • Upgrade Go environments to version 1.26.10, 1.27.3, or later and rebuild all compiled applications to incorporate the new cryptographic denylist.
  • Update Firefox to version 158.0.1, ESR 115.43.1, or ESR 153.5.1 and ensure NSS is patched to 3.131.1 or later.
  • Audit and update software dependencies that maintain embedded certificate bundles, specifically Python's 'certifi' and Rust's 'webpki-roots' (ensure version 1.0.10 or newer).
  • Monitor certificate chain telemetry for the presence of the eight identified compromised intermediate CA public keys.
]]>highadvisoryvulnerabilitybrowserclient-sidepkicertificate-authoritysupply-chaintlsinfrastructure-securityinformationalcryptographyweb-security