eMudhra intermediate CA private keys compromised
› eMudhra / emSign Global TLS intermediates; any client shipping Mozilla-style CA stores
- started
- Oct 18, 2026
- closed
- ongoing
- CVEs
- 1
- sources
- 8
## summary
Eight eMudhra Global TLS intermediate CA private keys were found to be cryptographically weak / recoverable (researcher report Oct 18). Mozilla, Chrome, Apple and Microsoft blocked the intermediates; eMudhra revoked them Oct 19 and the ECC root was distrusted as a precaution. Downstream runtimes that ship their own trust stores (Go, Node.js, Electron, Python certifi, curl, etc.) needed emergency CA-bundle updates so they stop trusting the compromised chains.
severity: Critical for trust infrastructure (impersonation of any site); Go tracks related fix as CVE-2026-111943
## cve ids[1]
## affected
- Clients trusting eMudhra ECC intermediates before Oct 17–21 2026 browser/OS/runtime blocks; Go before 1.27.3 / 1.26.10; Electron before 44.9.1 / 43.8.1 / 42.11.16; Node.js before the Oct 21 security releases
## fixed in
- Electron 44.9.1 / 43.8.1 / 42.11.16
- Go 1.27.3 / 1.26.10
- Node.js 22.23.4 / 24.22.1 / 26.12.1
- Python certifi 2026.10.19
- NSS 3.131.1
## updates by day[4]
▸Oct 21, 2026
permalink ↗eMudhra published statements; Node.js security release refreshed CA store.
▸Oct 20, 2026
permalink ↗Community tracker emudhra.we-have-a-problem.com listed patched software; Alpine/curl/certifi/Go/Electron updates rolled.
▸Oct 19, 2026
permalink ↗eMudhra revoked the eight intermediates; browsers continued emergency distrust.
▸Oct 18, 2026
permalink ↗Independent researcher reported weak/compromisable eMudhra intermediate keys to Apple, Google, Microsoft and Mozilla.
## advisories[2]
## news & write-ups[1]
## posts[5]
⚠️ UPDATE: eMUDHRA INTERMEDIATE CA PRIVATE KEYS PROVEN COMPROMISED, NOT JUST WEAK A new disclosure site for the eMudhra (emSign) incident confirms that the private keys of all eight affected intermediate CAs are compromised. To prove it, the original reporter signed a message t.co/dh7UYyF5JC
🚨 WEAK eMUDHRA CA KEYS TRIGGER EMERGENCY TRUST UPDATES ACROSS BROWSERS, GO AND PYTHON The private keys of eight eMudhra (emSign) intermediate CA certificates were generated so badly that anyone can recover them. A researcher reported it to the Chrome, Mozilla, Apple and t.co/NU2jaFYmzr
8 intermediate CA private keys from eMudhra have been compromised. Reported to Mozilla on Oct 17, browsers started emergency-blocking the certs within hours; Apple and Microsoft followed on the 19th and 20th. Go, Electron, Python certifi, Rust and NSS all pushed fixes. Update
Eight eMudhra intermediate CA private keys are compromised. They chain to roots trusted by Mozilla, Microsoft, Apple and Chrome, so whoever holds them could impersonate any site. Firefox, Chrome, Apple and Microsoft already block them. Apps that carry their own CA bundle don't
The private keys of eight eMudhra intermediate CA certificates have been compromised. They chain to roots trusted by the Mozilla, Microsoft, Apple and Chrome root programs and by many downstream trust stores. eMudhra (Emudhra Limited) is an Indian company. It is
## notes & caveats
eMudhra states intermediates never issued customer certs and infrastructure was not breached; browser root programs still distrust the ECC root. Bun still listed as pending on the community tracker as of last check — patchStatus partial. CVE-2026-111943 is the Go-side identifier reported by BleepingComputer; not every vendor assigned a CVE.
