{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/emsign-root-tls-ca---g1/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[{"id":"CVE-2026-111943"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Firefox","Firefox ESR","Thunderbird","Go (\u003c 1.26.10, \u003c 1.27.3)","Firefox (\u003c 158.0.1, \u003c ESR 115.43.1, \u003c ESR 153.5.1)","NSS (\u003c 3.131.1)","certifi","webpki-roots (\u003c 1.0.10)","Sonatype products and distributions","emSign ECC Root CA - G3","emSign Root CA - G1","emSign Root TLS CA - G1","CertiNext"],"_cs_severities":["high"],"_cs_tags":["vulnerability","browser","client-side","pki","certificate-authority","supply-chain","tls","infrastructure-security","informational","cryptography","web-security"],"_cs_type":"advisory","_cs_vendors":["Mozilla","eMudhra","Go","Python","Rust","Sonatype"],"content_html":"\u003cp\u003eOn October 17, 2026, a security researcher identified that eight intermediate certificate authorities operated by eMudhra possessed insecurely generated private keys, which could be independently recovered. This compromise allows an attacker to issue fraudulent, trusted TLS and code-signing certificates. While there is no evidence of widespread abuse prior to defensive actions, the severity of the cryptographic failure prompted immediate revocation and denylisting efforts across browsers and language runtimes. The Go Project released CVE-2026-111943 to hardcode a denylist of the affected keys in the crypto/x509 library to protect applications that do not rely on system-level certificate revocation mechanisms.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eAn attacker in possession of the compromised intermediate keys could potentially impersonate legitimate websites, intercept encrypted traffic, or sign malicious code. The risk is highest for applications that manage independent certificate bundles or runtimes that do not consume browser-based revocation lists like CRLSet or OneCRL.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade Go environments to version 1.26.10, 1.27.3, or later and rebuild all compiled applications to incorporate the new cryptographic denylist.\u003c/li\u003e\n\u003cli\u003eUpdate Firefox to version 158.0.1, ESR 115.43.1, or ESR 153.5.1 and ensure NSS is patched to 3.131.1 or later.\u003c/li\u003e\n\u003cli\u003eAudit and update software dependencies that maintain embedded certificate bundles, specifically Python's 'certifi' and Rust's 'webpki-roots' (ensure version 1.0.10 or newer).\u003c/li\u003e\n\u003cli\u003eMonitor certificate chain telemetry for the presence of the eight identified compromised intermediate CA public keys.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-22T18:48:09Z","date_published":"2026-10-21T14:19:28Z","id":"https://feed.craftedsignal.io/briefs/2026-10-emudhra-intermediate-ca-compromise/","summary":"The compromise of eight eMudhra intermediate certificate authority private keys due to a flawed key-generation process allows for the issuance of fraudulent, trusted certificates, necessitating urgent patches across programming language runtimes and browsers.","title":"eMudhra Intermediate Certificate Authority Compromise (CVE-2026-111943)","url":"https://feed.craftedsignal.io/briefs/2026-10-emudhra-intermediate-ca-compromise/"}],"language":"en","title":"CraftedSignal Threat Feed - EmSign Root TLS CA - G1","version":"https://jsonfeed.org/version/1.1"}