{
  "site": "https://pwn.watch",
  "generatedAt": "2026-10-22T17:40:31.642Z",
  "tag": {
    "id": "rust",
    "label": "Rust",
    "isStack": true,
    "url": "https://pwn.watch/t/rust",
    "feed": "https://pwn.watch/t/rust/feed.xml"
  },
  "counts": {
    "incidents": 3,
    "live": 2,
    "notFullyPatched": 2,
    "patched": 1
  },
  "incidents": [
    {
      "slug": "signal-ringrtc-cve-2026-113380",
      "title": "Signal calls can stay live after hang-up (RingRTC CVE-2026-113380)",
      "url": "https://pwn.watch/i/signal-ringrtc-cve-2026-113380",
      "json": "https://pwn.watch/i/signal-ringrtc-cve-2026-113380.json",
      "status": "closed",
      "severity": "critical",
      "patchStatus": "patched",
      "product": "Signal (RingRTC calling library, @signalapp/ringrtc)",
      "tags": [
        "rust",
        "npm",
        "ios",
        "android",
        "signal"
      ],
      "cveIds": [
        "CVE-2026-113380"
      ],
      "affectedVersions": [
        "RingRTC before 2.72.0 (Signal Android, iOS and Desktop clients embedding it)"
      ],
      "fixedVersions": [
        "RingRTC 2.72.0 (update Signal on every device)"
      ],
      "startedAt": "2026-10-20",
      "closedAt": "2026-10-22T18:00:43+02:00",
      "updatedAt": "2026-10-22T18:00:43+02:00",
      "summary": "A bug in RingRTC, the open-source library behind Signal's voice and video calls, lets the other party on a call flood the call's state-machine event queue so a local hang-up gets stuck behind the backlog, and audio (possibly video) keeps flowing to them after the victim thinks the call ended. Affects every Signal client (Android, iOS, Desktop) embedding RingRTC before 2.72.0. Fixed in RingRTC 2.72.0 (released Sep 4 2026, disclosed Oct 20); a conceptual PoC is public, no known exploitation.",
      "xPost": null
    },
    {
      "slug": "http3-qpack-header-accordions",
      "title": "HTTP/3 QPACK “Header Accordions” memory-amplification DoS",
      "url": "https://pwn.watch/i/http3-qpack-header-accordions",
      "json": "https://pwn.watch/i/http3-qpack-header-accordions.json",
      "status": "live",
      "severity": "unknown",
      "patchStatus": "partial",
      "product": "HTTP/3 / QPACK stacks (quic-go, Cloudflare quiche, lsquic, Bun, aioquic, h3, Wireshark, …)",
      "tags": [
        "go",
        "rust",
        "python",
        "cloudflare",
        "http3"
      ],
      "cveIds": [
        "CVE-2025-64702",
        "CVE-2026-12523",
        "CVE-2025-13945"
      ],
      "affectedVersions": [
        "See FoxIO table; Bun 1.4.3 and aioquic/mitmproxy unpatched as of Oct 20 2026"
      ],
      "fixedVersions": [
        "quic-go 0.57.0",
        "Cloudflare quiche 0.29.3",
        "lsquic 4.9.0",
        "Wireshark 4.6.2 / 4.4.12"
      ],
      "startedAt": "2026-10-20",
      "closedAt": null,
      "updatedAt": "2026-10-22T11:19:00+02:00",
      "summary": "FoxIO published research (Oct 20 2026) showing that missing or late decoded-header limits in QPACK let a tiny HTTP/3 HEADERS frame expand into huge server memory use (up to ~4000× on Bun). Seven of ten implementations tested were vulnerable; quic-go, Cloudflare quiche, lsquic and Wireshark are patched, while Bun, aioquic/mitmproxy and h3 remained unpatched at publication.",
      "xPost": null
    },
    {
      "slug": "emudhra-intermediate-ca-compromise",
      "title": "eMudhra intermediate CA private keys compromised",
      "url": "https://pwn.watch/i/emudhra-intermediate-ca-compromise",
      "json": "https://pwn.watch/i/emudhra-intermediate-ca-compromise.json",
      "status": "live",
      "severity": "critical",
      "patchStatus": "partial",
      "product": "eMudhra / emSign Global TLS intermediates; any client shipping Mozilla-style CA stores",
      "tags": [
        "python",
        "pypi",
        "go",
        "node",
        "java",
        "rust",
        "emudhra",
        "tls",
        "certifi",
        "pip",
        "uv"
      ],
      "cveIds": [
        "CVE-2026-111943",
        "CVE-2026-91403"
      ],
      "affectedVersions": [
        "Clients trusting eMudhra ECC intermediates before Oct 17–21 2026 browser/OS/runtime blocks; Go before 1.27.3 / 1.26.10; Electron before 44.9.1 / 43.8.1 / 42.11.16; Node.js before the Oct 21 security releases; Python certifi 2019.3.9 to before 2026.10.19 (GHSA-6q48-6c7w-9gw2), pip before 26.2.2 (vendored certifi), uv before 0.13.4"
      ],
      "fixedVersions": [
        "Electron 44.9.1 / 43.8.1 / 42.11.16",
        "Go 1.27.3 / 1.26.10",
        "Node.js 22.23.4 / 24.22.1 / 26.12.1",
        "Python certifi 2026.10.19",
        "NSS 3.131.1",
        "Java 27.0.1.0.2 / 25.0.5.0.2 / 21.0.13.0.2 / 17.0.21.0.2 / 11.0.33.0.2 / 8u511+ (CVE-2026-91403)",
        "Deno 2.9.8",
        "rustls-webpki 0.103.16 / webpki-roots 1.0.10",
        "pip 26.2.2 / uv 0.13.4 / sigstore 4.5.1 / conda 26.9.4 / pixi 0.82.1 (Python ecosystem)",
        "Ubuntu/Debian/Alpine/Fedora/Arch ca-certificates updates (see tracker)",
        "Docker Desktop 4.96.2",
        "mitmproxy 12.3.0"
      ],
      "startedAt": "2026-10-18",
      "closedAt": null,
      "updatedAt": "2026-10-22T19:29:47+02:00",
      "summary": "Eight eMudhra Global TLS intermediate CA private keys were found to be cryptographically weak / recoverable (researcher report Oct 18). Mozilla, Chrome, Apple and Microsoft blocked the intermediates; eMudhra revoked them Oct 19 and the ECC root was distrusted as a precaution. Downstream runtimes that ship their own trust stores (Go, Node.js, Electron, Python certifi, curl, etc.) needed emergency CA-bundle updates so they stop trusting the compromised chains.",
      "xPost": null
    }
  ],
  "posts": [
    {
      "authorName": "Laurent",
      "handle": "L4UR3N7",
      "avatarUrl": "https://pbs.twimg.com/profile_images/2016030962463707137/Sxwti3lj_bigger.jpg",
      "text": "🚨🚨🚨 ALERTE SÉCURITÉ MAXIMALE ! Python est compromis.\n\n🔸 Mettez immédiatement pip à la version 26.2.2 ou plus.\n🔸 Dans chaque projet Python (chaque venv) : python -m pip install --upgrade pip\n🔸 uv : uv self update (0.13.4 ou plus)\n🔸 Mettez aussi à jour les certificats du",
      "date": "2026-10-22T15:27:57.000Z",
      "url": "https://x.com/L4UR3N7/status/2113291274664976774",
      "media": [],
      "incident": "emudhra-intermediate-ca-compromise"
    },
    {
      "authorName": "IOActive, Inc",
      "handle": "IOActive",
      "avatarUrl": "https://pbs.twimg.com/profile_images/1039931315766870016/ahOvevDU_bigger.jpg",
      "text": "8 eMudhra intermediate TLS certs had private keys of just 3 to 8 bits. Anyone could have used them to mint trusted certs for any site.\n\nBrowsers have blocked them. Linux distros, containers, IoT, and embedded devices are another story. https://t.co/yCsyEJsqnO",
      "date": "2026-10-22T14:55:15.000Z",
      "url": "https://x.com/IOActive/status/2113283045671502288",
      "incident": "emudhra-intermediate-ca-compromise"
    },
    {
      "authorName": "Appwrite",
      "handle": "appwrite",
      "avatarUrl": "https://pbs.twimg.com/profile_images/2039591646095093760/w0wOnRMo_bigger.jpg",
      "text": "An update on PHP2Shell and the eMudhra certificate compromise.\n\nWe've confirmed that Appwrite is not affected by PHP2Shell. Appwrite Cloud is also patched for eMudhra in every region.\n \nHere's what we've checked and what self-hosted users should do. 🧵",
      "date": "2026-10-22T12:46:16.000Z",
      "url": "https://x.com/appwrite/status/2113250583998316980",
      "media": [],
      "incident": "emudhra-intermediate-ca-compromise"
    },
    {
      "authorName": "Moneycontrol",
      "handle": "moneycontrolcom",
      "avatarUrl": "https://pbs.twimg.com/profile_images/841519699632447488/ea4043nJ_bigger.jpg",
      "text": "#TechWithMC | eMudhra to exit global website security certificate business after key-generation flaw\n\nIts Indian digital signature and eSign services will continue to operate as usual\n\nRead More:\nhttps://t.co/AFxrCdzSlz",
      "date": "2026-10-22T11:55:49.000Z",
      "url": "https://x.com/moneycontrolcom/status/2113237890239214043",
      "incident": "emudhra-intermediate-ca-compromise"
    },
    {
      "authorName": "Internet Freedom Foundation (IFF)",
      "handle": "internetfreedom",
      "avatarUrl": "https://pbs.twimg.com/profile_images/1255541950070964225/6WdosHR2_bigger.jpg",
      "text": "A Certifying Authority used the number “4” as a private key.\n\neMudhra’s weak keys could let fraudsters fake your bank’s website, padlock included. We’ve written to eMudhra, the Controller of Certifying Authorities and CERT-In asking for a fix.\n\n#eMudhra #Cybersecurity https://t.co/VTxAGHqi6L",
      "date": "2026-10-22T11:42:57.000Z",
      "url": "https://x.com/internetfreedom/status/2113234649258615256",
      "media": [],
      "incident": "emudhra-intermediate-ca-compromise"
    },
    {
      "authorName": "The Daily Tech Feed",
      "handle": "dailytechonx",
      "avatarUrl": "https://pbs.twimg.com/profile_images/1889684200258764800/AEZLG4yL_bigger.jpg",
      "text": "HTTP/3 servers using QPACK are exposed to serious memory-amplification flaws. Attackers can crash servers with tiny compressed headers. Key stacks like quic-go, quiche, lsquic patched—but Bun, h3, aioquic still vulnerable. Mitigations needed now.\n\n#HTTP3 #QPACK #Vulnerability https://t.co/ZU7h7ky0XX",
      "date": "2026-10-22T07:02:21.000Z",
      "url": "https://x.com/dailytechonx/status/2113164033914175882",
      "media": [
        {
          "type": "image",
          "url": "https://pbs.twimg.com/media/HVN3faQWgAIF_bP.jpg"
        }
      ],
      "incident": "http3-qpack-header-accordions"
    },
    {
      "authorName": "kokumօtօ",
      "handle": "__kokumoto",
      "avatarUrl": "https://pbs.twimg.com/profile_images/1612504196720492544/T_-s-6OP_bigger.jpg",
      "text": "HTTP/3サーバ向けのDoS攻撃手法、QPACK増幅攻撃\"Header Accordions\"のPoC（攻撃の概念実証コード）と詳細が開示された。quic-go、Cloudflare quiche、Wiresharkは修正済み。Microsoft IIS、Envoy、Google quiche、ngtcp2/nghttp3は元々脆弱ではない。 https://t.co/iIRxIHmhnu",
      "date": "2026-10-22T03:32:49.000Z",
      "url": "https://x.com/__kokumoto/status/2113111305393750474",
      "media": [],
      "incident": "http3-qpack-header-accordions"
    },
    {
      "authorName": "azu",
      "handle": "azu_re",
      "avatarUrl": "https://pbs.twimg.com/profile_images/1081057521719078912/OqWfdeQ6_bigger.jpg",
      "text": "QUICの多くの実装でのOOM \"Header Accordions: QPACK amplification attacks against HTTP/3 servers - FoxIO | Cyber Innovation\" https://t.co/qEjI9cftas",
      "date": "2026-10-21T23:49:44.000Z",
      "url": "https://x.com/azu_re/status/2113055165100286299",
      "media": [],
      "incident": "http3-qpack-header-accordions"
    },
    {
      "authorName": "Cybersecurity News Everyday",
      "handle": "TweetThreatNews",
      "avatarUrl": "https://pbs.twimg.com/profile_images/2043130207125848064/YaxtN2hq_bigger.jpg",
      "text": "CVE-2026-113380 affects RingRTC versions before 2.72.0 and could let a call participant keep hearing audio after hang-up. No in-the-wild exploitation is known; users are advised to update Signal.",
      "date": "2026-10-21T22:48:16.000Z",
      "url": "https://x.com/TweetThreatNews/status/2113039694753636745",
      "media": [],
      "incident": "signal-ringrtc-cve-2026-113380"
    },
    {
      "authorName": "tsn_hub",
      "handle": "tsnmediahub",
      "avatarUrl": "https://pbs.twimg.com/profile_images/1892172141111496704/d_EnIiZO_bigger.jpg",
      "text": "📵 Update Signal. A critical flaw in its RingRTC calling library could stop a call ending when you hang up, leaving audio and perhaps video running, per its CVE record. RingRTC 2.72.0 fixes it. There's no report of exploitation.\n\nSource: CVE-2026-113380 record",
      "date": "2026-10-21T18:52:01.000Z",
      "url": "https://x.com/tsnmediahub/status/2112980243162026149",
      "media": [],
      "incident": "signal-ringrtc-cve-2026-113380"
    },
    {
      "authorName": "ET NOW",
      "handle": "ETNOWlive",
      "avatarUrl": "https://pbs.twimg.com/profile_images/1863866767027933184/hC9WqRl-_bigger.jpg",
      "text": "#NewsAlert | MeitY says: Impact of eMudhra incident on Indian websites, apps was limited\n\nEngages stakeholders to resolve eMudhra incident; here are the other key statements👇\n\n@GoI_MeitY https://t.co/qeeVfhni77",
      "date": "2026-10-21T14:32:04.000Z",
      "url": "https://x.com/ETNOWlive/status/2112914822019137966",
      "media": [],
      "incident": "emudhra-intermediate-ca-compromise"
    },
    {
      "authorName": "Dark Web Intelligence",
      "handle": "DailyDarkWeb",
      "avatarUrl": "https://pbs.twimg.com/profile_images/1507666522008915969/T-CQnTJy_bigger.jpg",
      "text": "⚠️ UPDATE: eMUDHRA INTERMEDIATE CA PRIVATE KEYS PROVEN COMPROMISED, NOT JUST WEAK\n\nA new disclosure site for the eMudhra (emSign) incident confirms that the private keys of all eight affected intermediate CAs are compromised. To prove it, the original reporter signed a message https://t.co/dh7UYyF5JC",
      "date": "2026-10-20T23:14:17.000Z",
      "url": "https://x.com/DailyDarkWeb/status/2112683854356152830",
      "media": [
        {
          "type": "image",
          "url": "https://pbs.twimg.com/media/HVHCw9TbUAEtlZa.jpg"
        }
      ],
      "incident": "emudhra-intermediate-ca-compromise"
    },
    {
      "authorName": "flow in 🏴‍☠️",
      "handle": "flowirin",
      "avatarUrl": "https://pbs.twimg.com/profile_images/1779389632750428160/DA8czVom_bigger.jpg",
      "text": "The private keys of eight eMudhra intermediate CA certificates have been compromised. \n\nThey chain to roots trusted by the Mozilla, Microsoft, Apple and Chrome root programs and by many downstream trust stores.\n\n eMudhra (Emudhra Limited) is an Indian company.⁠\n\nIt is",
      "date": "2026-10-20T20:31:12.000Z",
      "url": "https://x.com/flowirin/status/2112642813259301083",
      "media": [],
      "incident": "emudhra-intermediate-ca-compromise"
    },
    {
      "authorName": "Dark Web Intelligence",
      "handle": "DailyDarkWeb",
      "avatarUrl": "https://pbs.twimg.com/profile_images/1507666522008915969/T-CQnTJy_bigger.jpg",
      "text": "🚨 WEAK eMUDHRA CA KEYS TRIGGER EMERGENCY TRUST UPDATES ACROSS BROWSERS, GO AND PYTHON\n\nThe private keys of eight eMudhra (emSign) intermediate CA certificates were generated so badly that anyone can recover them. A researcher reported it to the Chrome, Mozilla, Apple and https://t.co/NU2jaFYmzr",
      "date": "2026-10-20T19:14:12.000Z",
      "url": "https://x.com/DailyDarkWeb/status/2112623438049497364",
      "media": [
        {
          "type": "image",
          "url": "https://pbs.twimg.com/media/HVGL0TgbgAAMXNS.jpg"
        }
      ],
      "incident": "emudhra-intermediate-ca-compromise"
    },
    {
      "authorName": "CloudDog",
      "handle": "CloudDogx",
      "avatarUrl": "https://pbs.twimg.com/profile_images/2106561242634825728/kAz3w_Hc_bigger.jpg",
      "text": "8 intermediate CA private keys from eMudhra have been compromised. Reported to Mozilla on Oct 17, browsers started emergency-blocking the certs within hours; Apple and Microsoft followed on the 19th and 20th. Go, Electron, Python certifi, Rust and NSS all pushed fixes. Update",
      "date": "2026-10-20T18:35:18.000Z",
      "url": "https://x.com/CloudDogx/status/2112613648388739471",
      "media": [],
      "incident": "emudhra-intermediate-ca-compromise"
    },
    {
      "authorName": "Charlie Marsh",
      "handle": "charliermarsh",
      "avatarUrl": "https://pbs.twimg.com/profile_images/1490182599981125634/ex0Jezvf_bigger.jpg",
      "text": "We just released uv 0.13.4, which updates our bundled certs in response to the eMudra incident.\n\nThis is a huge deal, and not unique to uv! It affects much of open source due to bundled CAs in certifi, webpki-root-certs, etc. Please upgrade anything that bundles CA certs.",
      "date": "2026-10-20T17:36:56.000Z",
      "url": "https://x.com/charliermarsh/status/2112598956996010030",
      "media": [],
      "incident": "emudhra-intermediate-ca-compromise"
    },
    {
      "authorName": "Xavier Rivera",
      "handle": "XavierRiveraX",
      "avatarUrl": "https://pbs.twimg.com/profile_images/2102132195200479232/2hHv0Px0_bigger.jpg",
      "text": "Eight eMudhra intermediate CA private keys are compromised. They chain to roots trusted by Mozilla, Microsoft, Apple and Chrome, so whoever holds them could impersonate any site.\n\nFirefox, Chrome, Apple and Microsoft already block them. Apps that carry their own CA bundle don't",
      "date": "2026-10-20T14:44:43.000Z",
      "url": "https://x.com/XavierRiveraX/status/2112555618019971544",
      "media": [],
      "incident": "emudhra-intermediate-ca-compromise"
    }
  ],
  "changes": [
    {
      "incident": "signal-ringrtc-cve-2026-113380",
      "incidentTitle": "Signal calls can stay live after hang-up (RingRTC CVE-2026-113380)",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2026-10-22",
      "title": "No known exploitation; CISA has not added it to KEV and NVD lists it as awaiting analysis.",
      "body": null,
      "sourceUrl": "https://www.helpnetsecurity.com/2026/10/22/signal-ringrtc-vulnerability-cve-2026-113380/",
      "url": "https://pwn.watch/i/signal-ringrtc-cve-2026-113380"
    },
    {
      "incident": "signal-ringrtc-cve-2026-113380",
      "incidentTitle": "Signal calls can stay live after hang-up (RingRTC CVE-2026-113380)",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2026-10-22",
      "title": "SecurityWeek: the hang-up was queued behind peer events with no rate limit or priority; the fix makes call termination bypass the queue. Users should update Signal and check the call indicator after hanging up.",
      "body": null,
      "sourceUrl": "https://www.securityweek.com/signal-vulnerability-lets-malicious-callers-block-hang-ups/",
      "url": "https://pwn.watch/i/signal-ringrtc-cve-2026-113380"
    },
    {
      "incident": "signal-ringrtc-cve-2026-113380",
      "incidentTitle": "Signal calls can stay live after hang-up (RingRTC CVE-2026-113380)",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2026-10-22",
      "title": "Closed on pwn.watch: the fix shipped Sep 4 (RingRTC 2.72.0), there is still no known exploitation and no new developments, so this is now a patch-and-move-on item. Make sure Signal is updated on every device.",
      "body": null,
      "sourceUrl": "https://www.securityweek.com/signal-vulnerability-lets-malicious-callers-block-hang-ups/",
      "url": "https://pwn.watch/i/signal-ringrtc-cve-2026-113380"
    },
    {
      "incident": "emudhra-intermediate-ca-compromise",
      "incidentTitle": "eMudhra intermediate CA private keys compromised",
      "severity": "critical",
      "status": "live",
      "patchStatus": "partial",
      "date": "2026-10-22",
      "title": "Tracker lists patched releases across distros, language runtimes and tools; Bun, Erlang certifi and Bottlerocket still pending. mitmproxy 12.3.0 drops eMudhra CAs.",
      "body": null,
      "sourceUrl": "https://emudhra.we-have-a-problem.com/",
      "url": "https://pwn.watch/i/emudhra-intermediate-ca-compromise"
    },
    {
      "incident": "emudhra-intermediate-ca-compromise",
      "incidentTitle": "eMudhra intermediate CA private keys compromised",
      "severity": "critical",
      "status": "live",
      "patchStatus": "partial",
      "date": "2026-10-22",
      "title": "eMudhra says a flaw in its April 30 2025 key generation ceremony produced a second set of weak keys, and those were the ones published to root stores; root cause still under investigation, replacement certs being issued to customers.",
      "body": null,
      "sourceUrl": "https://www.theregister.com/security/2026/10/22/certification-authority-emudhra-defends-its-laughably-weak-private-keys/5304647",
      "url": "https://pwn.watch/i/emudhra-intermediate-ca-compromise"
    },
    {
      "incident": "emudhra-intermediate-ca-compromise",
      "incidentTitle": "eMudhra intermediate CA private keys compromised",
      "severity": "critical",
      "status": "live",
      "patchStatus": "partial",
      "date": "2026-10-22",
      "title": "Internet Freedom Foundation says it has written to eMudhra, India’s Controller of Certifying Authorities and CERT-In asking for a fix.",
      "body": null,
      "sourceUrl": "https://x.com/internetfreedom/status/2113234649258615256",
      "url": "https://pwn.watch/i/emudhra-intermediate-ca-compromise"
    },
    {
      "incident": "emudhra-intermediate-ca-compromise",
      "incidentTitle": "eMudhra intermediate CA private keys compromised",
      "severity": "critical",
      "status": "live",
      "patchStatus": "partial",
      "date": "2026-10-22",
      "title": "eMudhra's board decides to exit the global SSL/TLS certificate business (about 1% of revenue); existing certificates stay supported until expiry or replacement, revocation and status services stay up, and its Indian DSC and eSign businesses continue.",
      "body": null,
      "sourceUrl": "https://www.moneycontrol.com/technology/emudhra-to-exit-global-website-security-certificate-business-after-key-generation-flaw-article-14057821.html",
      "url": "https://pwn.watch/i/emudhra-intermediate-ca-compromise"
    },
    {
      "incident": "emudhra-intermediate-ca-compromise",
      "incidentTitle": "eMudhra intermediate CA private keys compromised",
      "severity": "critical",
      "status": "live",
      "patchStatus": "partial",
      "date": "2026-10-22",
      "title": "Co-founder Kaushik Srinivasan blames human error and a script failure in the Apr 30 2025 key ceremony (no maker-checker controls), says the eight issuers never issued end-entity certificates and there was no breach; one US customer has about 30,000 certificates on the distrusted ECC chain, while its RSA chain stays trusted.",
      "body": null,
      "sourceUrl": "https://www.tribuneindia.com/news/business/emudhra-attributes-certificate-security-incident-to-human-error-co-founder-says-few-customers-directly-affected/",
      "url": "https://pwn.watch/i/emudhra-intermediate-ca-compromise"
    },
    {
      "incident": "signal-ringrtc-cve-2026-113380",
      "incidentTitle": "Signal calls can stay live after hang-up (RingRTC CVE-2026-113380)",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2026-10-21",
      "title": "Researcher Imahian's write-up and conceptual PoC circulate; press coverage begins.",
      "body": null,
      "sourceUrl": "https://www.theregister.com/security/2026/10/21/signal-bug-could-keep-your-mic-and-camera-on-after-hangup/5304528",
      "url": "https://pwn.watch/i/signal-ringrtc-cve-2026-113380"
    },
    {
      "incident": "emudhra-intermediate-ca-compromise",
      "incidentTitle": "eMudhra intermediate CA private keys compromised",
      "severity": "critical",
      "status": "live",
      "patchStatus": "partial",
      "date": "2026-10-21",
      "title": "eMudhra published statements; Node.js security release refreshed CA store.",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/emudhra-intermediate-ca-compromise"
    },
    {
      "incident": "emudhra-intermediate-ca-compromise",
      "incidentTitle": "eMudhra intermediate CA private keys compromised",
      "severity": "critical",
      "status": "live",
      "patchStatus": "partial",
      "date": "2026-10-21",
      "title": "Oracle and OpenJDK publish CVE-2026-91403 (CVSS 9.1, JSSE): Java updates distrust the eight intermediates; blocked.certs / revocation-check workaround provided.",
      "body": null,
      "sourceUrl": "https://openjdk.org/groups/vulnerability/advisories/2026-10-21",
      "url": "https://pwn.watch/i/emudhra-intermediate-ca-compromise"
    },
    {
      "incident": "emudhra-intermediate-ca-compromise",
      "incidentTitle": "eMudhra intermediate CA private keys compromised",
      "severity": "critical",
      "status": "live",
      "patchStatus": "partial",
      "date": "2026-10-21",
      "title": "India's MeitY forms a special team to probe the incident; says impact on Indian websites and apps was limited.",
      "body": null,
      "sourceUrl": "https://x.com/ETNOWlive/status/2112914822019137966",
      "url": "https://pwn.watch/i/emudhra-intermediate-ca-compromise"
    },
    {
      "incident": "signal-ringrtc-cve-2026-113380",
      "incidentTitle": "Signal calls can stay live after hang-up (RingRTC CVE-2026-113380)",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2026-10-20",
      "title": "CVE-2026-113380 published by MITRE (CVSS 4.0 9.3); fix is RingRTC 2.72.0.",
      "body": null,
      "sourceUrl": "https://www.cve.org/CVERecord?id=CVE-2026-113380",
      "url": "https://pwn.watch/i/signal-ringrtc-cve-2026-113380"
    },
    {
      "incident": "http3-qpack-header-accordions",
      "incidentTitle": "HTTP/3 QPACK “Header Accordions” memory-amplification DoS",
      "severity": "unknown",
      "status": "live",
      "patchStatus": "partial",
      "date": "2026-10-20",
      "title": "FoxIO blog + PoC published; several stacks still unpatched.",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/http3-qpack-header-accordions"
    },
    {
      "incident": "emudhra-intermediate-ca-compromise",
      "incidentTitle": "eMudhra intermediate CA private keys compromised",
      "severity": "critical",
      "status": "live",
      "patchStatus": "partial",
      "date": "2026-10-20",
      "title": "Community tracker emudhra.we-have-a-problem.com listed patched software; Alpine/curl/certifi/Go/Electron updates rolled.",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/emudhra-intermediate-ca-compromise"
    },
    {
      "incident": "emudhra-intermediate-ca-compromise",
      "incidentTitle": "eMudhra intermediate CA private keys compromised",
      "severity": "critical",
      "status": "live",
      "patchStatus": "partial",
      "date": "2026-10-20",
      "title": "Python: certifi 2026.10.18 drops all emSign roots (GHSA-6q48-6c7w-9gw2, CVSS 7.4); 2026.10.19 restores the unaffected ones. pip 26.2.2 vendors the new certifi and uv 0.13.4 refreshes its bundled Mozilla roots (GHSA-hq85-5cpj-mr62).",
      "body": null,
      "sourceUrl": "https://advisories.gitlab.com/pypi/certifi/GHSA-6q48-6c7w-9gw2/",
      "url": "https://pwn.watch/i/emudhra-intermediate-ca-compromise"
    },
    {
      "incident": "emudhra-intermediate-ca-compromise",
      "incidentTitle": "eMudhra intermediate CA private keys compromised",
      "severity": "critical",
      "status": "live",
      "patchStatus": "partial",
      "date": "2026-10-20",
      "title": "Python Software Foundation's Seth Larson tells Python users to upgrade certifi 2026.10.19, pip 26.2.2, uv 0.13.4, sigstore 4.5.1, conda 26.9.4 and pixi 0.82.1 in every venv and rebuild container images. pip below 26.2.2 keeps trusting the bad CAs through its vendored certifi even if the OS store is fixed, so pip itself has to be upgraded.",
      "body": null,
      "sourceUrl": "https://discuss.python.org/t/information-for-python-users-regarding-emudhra-emsign-ca-certificate-security-incident/109576",
      "url": "https://pwn.watch/i/emudhra-intermediate-ca-compromise"
    },
    {
      "incident": "emudhra-intermediate-ca-compromise",
      "incidentTitle": "eMudhra intermediate CA private keys compromised",
      "severity": "critical",
      "status": "live",
      "patchStatus": "partial",
      "date": "2026-10-19",
      "title": "eMudhra revoked the eight intermediates; browsers continued emergency distrust.",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/emudhra-intermediate-ca-compromise"
    },
    {
      "incident": "emudhra-intermediate-ca-compromise",
      "incidentTitle": "eMudhra intermediate CA private keys compromised",
      "severity": "critical",
      "status": "live",
      "patchStatus": "partial",
      "date": "2026-10-18",
      "title": "Independent researcher reported weak/compromisable eMudhra intermediate keys to Apple, Google, Microsoft and Mozilla.",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/emudhra-intermediate-ca-compromise"
    },
    {
      "incident": "signal-ringrtc-cve-2026-113380",
      "incidentTitle": "Signal calls can stay live after hang-up (RingRTC CVE-2026-113380)",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2026-09-04",
      "title": "Signal quietly fixes the bug in RingRTC 2.72.0 (commit \"Ensure calls terminate completely in corner cases\"), about six weeks before disclosure.",
      "body": null,
      "sourceUrl": "https://github.com/signalapp/ringrtc/commit/4b1b6fa53c9f30c87c8ea78e44675d4a13e1e4d3",
      "url": "https://pwn.watch/i/signal-ringrtc-cve-2026-113380"
    },
    {
      "incident": "http3-qpack-header-accordions",
      "incidentTitle": "HTTP/3 QPACK “Header Accordions” memory-amplification DoS",
      "severity": "unknown",
      "status": "live",
      "patchStatus": "partial",
      "date": "2025-11 → 2026-07",
      "title": "Responsible reports to quic-go, quiche, Bun, aioquic, lsquic, h3.",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/http3-qpack-header-accordions"
    }
  ]
}