pwn.watch: Rust incident updates

[critical] eMudhra intermediate CA private keys compromised

Thu, 22 Oct 2026 17:29:47 GMT

Eight eMudhra Global TLS intermediate CA private keys were found to be cryptographically weak / recoverable (researcher report Oct 18). Mozilla, Chrome, Apple and Microsoft blocked the intermediates; eMudhra revoked them Oct 19 and the ECC root was distrusted as a precaution. Downstream runtimes that ship their own trust stores (Go, Node.js, Electron, Python certifi, curl, etc.) needed emergency CA-bundle updates so they stop trusting the compromised chains.

Status: live · Patch: partial · Fixed in: Electron 44.9.1 / 43.8.1 / 42.11.16, Go 1.27.3 / 1.26.10, Node.js 22.23.4 / 24.22.1 / 26.12.1, Python certifi 2026.10.19, NSS 3.131.1, Java 27.0.1.0.2 / 25.0.5.0.2 / 21.0.13.0.2 / 17.0.21.0.2 / 11.0.33.0.2 / 8u511+ (CVE-2026-91403), Deno 2.9.8, rustls-webpki 0.103.16 / webpki-roots 1.0.10, pip 26.2.2 / uv 0.13.4 / sigstore 4.5.1 / conda 26.9.4 / pixi 0.82.1 (Python ecosystem), Ubuntu/Debian/Alpine/Fedora/Arch ca-certificates updates (see tracker), Docker Desktop 4.96.2, mitmproxy 12.3.0

Latest updates:

2026-10-22: Tracker lists patched releases across distros, language runtimes and tools; Bun, Erlang certifi and Bottlerocket still pending. mitmproxy 12.3.0 drops eMudhra CAs. (source)
2026-10-22: eMudhra says a flaw in its April 30 2025 key generation ceremony produced a second set of weak keys, and those were the ones published to root stores; root cause still under investigation, replacement certs being issued to customers. (source)
2026-10-22: Internet Freedom Foundation says it has written to eMudhra, India’s Controller of Certifying Authorities and CERT-In asking for a fix. (source)

CVEs: CVE-2026-111943, CVE-2026-91403

[critical] Signal calls can stay live after hang-up (RingRTC CVE-2026-113380)

Thu, 22 Oct 2026 16:00:43 GMT

A bug in RingRTC, the open-source library behind Signal's voice and video calls, lets the other party on a call flood the call's state-machine event queue so a local hang-up gets stuck behind the backlog, and audio (possibly video) keeps flowing to them after the victim thinks the call ended. Affects every Signal client (Android, iOS, Desktop) embedding RingRTC before 2.72.0. Fixed in RingRTC 2.72.0 (released Sep 4 2026, disclosed Oct 20); a conceptual PoC is public, no known exploitation.

Status: closed · Patch: patched · Fixed in: RingRTC 2.72.0 (update Signal on every device)

Latest updates:

2026-10-22: No known exploitation; CISA has not added it to KEV and NVD lists it as awaiting analysis. (source)
2026-10-22: SecurityWeek: the hang-up was queued behind peer events with no rate limit or priority; the fix makes call termination bypass the queue. Users should update Signal and check the call indicator after hanging up. (source)
2026-10-22: Closed on pwn.watch: the fix shipped Sep 4 (RingRTC 2.72.0), there is still no known exploitation and no new developments, so this is now a patch-and-move-on item. Make sure Signal is updated on every device. (source)

CVEs: CVE-2026-113380

[unknown] HTTP/3 QPACK “Header Accordions” memory-amplification DoS

Thu, 22 Oct 2026 09:19:00 GMT

FoxIO published research (Oct 20 2026) showing that missing or late decoded-header limits in QPACK let a tiny HTTP/3 HEADERS frame expand into huge server memory use (up to ~4000× on Bun). Seven of ten implementations tested were vulnerable; quic-go, Cloudflare quiche, lsquic and Wireshark are patched, while Bun, aioquic/mitmproxy and h3 remained unpatched at publication.

Status: live · Patch: partial · Fixed in: quic-go 0.57.0, Cloudflare quiche 0.29.3, lsquic 4.9.0, Wireshark 4.6.2 / 4.4.12

Latest updates:

2026-10-20: FoxIO blog + PoC published; several stacks still unpatched.
2025-11 → 2026-07: Responsible reports to quic-go, quiche, Bun, aioquic, lsquic, h3.

CVEs: CVE-2025-64702, CVE-2026-12523, CVE-2025-13945