{
  "site": "https://pwn.watch",
  "generatedAt": "2026-10-22T17:37:12.278Z",
  "tag": {
    "id": "tls",
    "label": "TLS",
    "isStack": false,
    "url": "https://pwn.watch/t/tls",
    "feed": "https://pwn.watch/t/tls/feed.xml"
  },
  "counts": {
    "incidents": 4,
    "live": 3,
    "notFullyPatched": 2,
    "patched": 2
  },
  "incidents": [
    {
      "slug": "nodejs-october-2026-security-releases",
      "title": "Node.js October 2026 security releases (Brotli RCE + TLS/DNS highs)",
      "url": "https://pwn.watch/i/nodejs-october-2026-security-releases",
      "json": "https://pwn.watch/i/nodejs-october-2026-security-releases.json",
      "status": "live",
      "severity": "high",
      "patchStatus": "patched",
      "product": "Node.js",
      "tags": [
        "node",
        "emudhra",
        "tls",
        "rce"
      ],
      "cveIds": [
        "CVE-2026-111497",
        "CVE-2026-105482",
        "CVE-2026-105483",
        "CVE-2026-106069",
        "CVE-2026-105481",
        "CVE-2026-106072",
        "CVE-2026-106074",
        "CVE-2026-106070",
        "CVE-2026-106071",
        "CVE-2026-106073"
      ],
      "affectedVersions": [
        "22.x, 24.x, 26.x (EOL lines not patched)"
      ],
      "fixedVersions": [
        "22.23.4",
        "24.22.1",
        "26.12.1"
      ],
      "startedAt": "2026-10-21",
      "closedAt": null,
      "updatedAt": "2026-10-22T11:18:00+02:00",
      "summary": "On Oct 21 2026 Node.js shipped security updates for 22.x, 24.x and 26.x fixing ten vulnerabilities. The headline issue is CVE-2026-111497, a high-severity Brotli decoder out-of-bounds write that can enable remote code execution when attacker-controlled Brotli data is decoded. The same release also fixes TLS hostname/IP bypasses and DNS NUL truncation, and refreshes the bundled CA store for the eMudhra incident.",
      "xPost": null
    },
    {
      "slug": "emudhra-intermediate-ca-compromise",
      "title": "eMudhra intermediate CA private keys compromised",
      "url": "https://pwn.watch/i/emudhra-intermediate-ca-compromise",
      "json": "https://pwn.watch/i/emudhra-intermediate-ca-compromise.json",
      "status": "live",
      "severity": "critical",
      "patchStatus": "partial",
      "product": "eMudhra / emSign Global TLS intermediates; any client shipping Mozilla-style CA stores",
      "tags": [
        "python",
        "pypi",
        "go",
        "node",
        "java",
        "rust",
        "emudhra",
        "tls",
        "certifi",
        "pip",
        "uv"
      ],
      "cveIds": [
        "CVE-2026-111943",
        "CVE-2026-91403"
      ],
      "affectedVersions": [
        "Clients trusting eMudhra ECC intermediates before Oct 17–21 2026 browser/OS/runtime blocks; Go before 1.27.3 / 1.26.10; Electron before 44.9.1 / 43.8.1 / 42.11.16; Node.js before the Oct 21 security releases; Python certifi 2019.3.9 to before 2026.10.19 (GHSA-6q48-6c7w-9gw2), pip before 26.2.2 (vendored certifi), uv before 0.13.4"
      ],
      "fixedVersions": [
        "Electron 44.9.1 / 43.8.1 / 42.11.16",
        "Go 1.27.3 / 1.26.10",
        "Node.js 22.23.4 / 24.22.1 / 26.12.1",
        "Python certifi 2026.10.19",
        "NSS 3.131.1",
        "Java 27.0.1.0.2 / 25.0.5.0.2 / 21.0.13.0.2 / 17.0.21.0.2 / 11.0.33.0.2 / 8u511+ (CVE-2026-91403)",
        "Deno 2.9.8",
        "rustls-webpki 0.103.16 / webpki-roots 1.0.10",
        "pip 26.2.2 / uv 0.13.4 / sigstore 4.5.1 / conda 26.9.4 / pixi 0.82.1 (Python ecosystem)",
        "Ubuntu/Debian/Alpine/Fedora/Arch ca-certificates updates (see tracker)",
        "Docker Desktop 4.96.2",
        "mitmproxy 12.3.0"
      ],
      "startedAt": "2026-10-18",
      "closedAt": null,
      "updatedAt": "2026-10-22T19:29:47+02:00",
      "summary": "Eight eMudhra Global TLS intermediate CA private keys were found to be cryptographically weak / recoverable (researcher report Oct 18). Mozilla, Chrome, Apple and Microsoft blocked the intermediates; eMudhra revoked them Oct 19 and the ECC root was distrusted as a precaution. Downstream runtimes that ship their own trust stores (Go, Node.js, Electron, Python certifi, curl, etc.) needed emergency CA-bundle updates so they stop trusting the compromised chains.",
      "xPost": null
    },
    {
      "slug": "godaddy-mass-certificate-revocation-oct-2026",
      "title": "GoDaddy mass-revokes 404,607 TLS certificates over CP/CPS profile mismatch",
      "url": "https://pwn.watch/i/godaddy-mass-certificate-revocation-oct-2026",
      "json": "https://pwn.watch/i/godaddy-mass-certificate-revocation-oct-2026.json",
      "status": "live",
      "severity": "medium",
      "patchStatus": "partial",
      "product": "GoDaddy / Starfield TLS certificates (DV, OV, EV)",
      "tags": [
        "hosting",
        "godaddy",
        "tls"
      ],
      "cveIds": [],
      "affectedVersions": [
        "404,607 certificates from Starfield R1/G2 and GoDaddy R1 intermediates (396,055 of them DV from Starfield R1 and G2)"
      ],
      "fixedVersions": [
        "Re-issued certificates from the GoDaddy SSL dashboard (customer must install them)"
      ],
      "startedAt": "2026-10-14",
      "closedAt": null,
      "updatedAt": "2026-10-22T14:58:57+02:00",
      "summary": "GoDaddy (Starfield) found that 404,607 TLS certificates carried policy information (policy OIDs, CPS URI) that didn't match its own published CP/CPS, which under the CA/Browser Forum Baseline Requirements means they must be revoked within five days. GoDaddy missed the Oct 18 deadline and says the certificates were revoked on Oct 21 2026. Nothing was hacked and no keys leaked, but sites still serving a revoked certificate can show browser warnings or become unreachable until the re-issued certificate is installed.",
      "xPost": null
    },
    {
      "slug": "nginx-october-2026-advisories",
      "title": "nginx 1.31.7 / 1.30.6 security fixes (HTTP/3, TLS tickets, overflows)",
      "url": "https://pwn.watch/i/nginx-october-2026-advisories",
      "json": "https://pwn.watch/i/nginx-october-2026-advisories.json",
      "status": "closed",
      "severity": "medium",
      "patchStatus": "patched",
      "product": "nginx",
      "tags": [
        "nginx",
        "http3",
        "tls"
      ],
      "cveIds": [
        "CVE-2026-15176",
        "CVE-2026-93479",
        "CVE-2026-95101",
        "CVE-2026-97629",
        "CVE-2026-97205"
      ],
      "affectedVersions": [
        "Varies per CVE; generally mainline before 1.31.7 and stable before 1.30.6"
      ],
      "fixedVersions": [
        "1.31.7+",
        "1.30.6+"
      ],
      "startedAt": "2026-10-14",
      "closedAt": "2026-10-14",
      "updatedAt": "2026-10-22T11:20:00+02:00",
      "summary": "nginx published multiple medium/major advisories fixed in 1.31.7+ and 1.30.6+, including HTTP/3 request-body injection (CVE-2026-95101), TLS session-ticket forgery (CVE-2026-97629), AIO use-after-free (CVE-2026-97205), and buffer overflows in alias/rewrite and map/regex paths. Same-day chatter bundled this with the PHP/Node/GitLab rush for anyone terminating HTTP on nginx.",
      "xPost": null
    }
  ],
  "posts": [
    {
      "authorName": "Laurent",
      "handle": "L4UR3N7",
      "avatarUrl": "https://pbs.twimg.com/profile_images/2016030962463707137/Sxwti3lj_bigger.jpg",
      "text": "🚨🚨🚨 ALERTE SÉCURITÉ MAXIMALE ! Python est compromis.\n\n🔸 Mettez immédiatement pip à la version 26.2.2 ou plus.\n🔸 Dans chaque projet Python (chaque venv) : python -m pip install --upgrade pip\n🔸 uv : uv self update (0.13.4 ou plus)\n🔸 Mettez aussi à jour les certificats du",
      "date": "2026-10-22T15:27:57.000Z",
      "url": "https://x.com/L4UR3N7/status/2113291274664976774",
      "media": [],
      "incident": "emudhra-intermediate-ca-compromise"
    },
    {
      "authorName": "IOActive, Inc",
      "handle": "IOActive",
      "avatarUrl": "https://pbs.twimg.com/profile_images/1039931315766870016/ahOvevDU_bigger.jpg",
      "text": "8 eMudhra intermediate TLS certs had private keys of just 3 to 8 bits. Anyone could have used them to mint trusted certs for any site.\n\nBrowsers have blocked them. Linux distros, containers, IoT, and embedded devices are another story. https://t.co/yCsyEJsqnO",
      "date": "2026-10-22T14:55:15.000Z",
      "url": "https://x.com/IOActive/status/2113283045671502288",
      "incident": "emudhra-intermediate-ca-compromise"
    },
    {
      "authorName": "Appwrite",
      "handle": "appwrite",
      "avatarUrl": "https://pbs.twimg.com/profile_images/2039591646095093760/w0wOnRMo_bigger.jpg",
      "text": "An update on PHP2Shell and the eMudhra certificate compromise.\n\nWe've confirmed that Appwrite is not affected by PHP2Shell. Appwrite Cloud is also patched for eMudhra in every region.\n \nHere's what we've checked and what self-hosted users should do. 🧵",
      "date": "2026-10-22T12:46:16.000Z",
      "url": "https://x.com/appwrite/status/2113250583998316980",
      "media": [],
      "incident": "emudhra-intermediate-ca-compromise"
    },
    {
      "authorName": "Moneycontrol",
      "handle": "moneycontrolcom",
      "avatarUrl": "https://pbs.twimg.com/profile_images/841519699632447488/ea4043nJ_bigger.jpg",
      "text": "#TechWithMC | eMudhra to exit global website security certificate business after key-generation flaw\n\nIts Indian digital signature and eSign services will continue to operate as usual\n\nRead More:\nhttps://t.co/AFxrCdzSlz",
      "date": "2026-10-22T11:55:49.000Z",
      "url": "https://x.com/moneycontrolcom/status/2113237890239214043",
      "incident": "emudhra-intermediate-ca-compromise"
    },
    {
      "authorName": "Internet Freedom Foundation (IFF)",
      "handle": "internetfreedom",
      "avatarUrl": "https://pbs.twimg.com/profile_images/1255541950070964225/6WdosHR2_bigger.jpg",
      "text": "A Certifying Authority used the number “4” as a private key.\n\neMudhra’s weak keys could let fraudsters fake your bank’s website, padlock included. We’ve written to eMudhra, the Controller of Certifying Authorities and CERT-In asking for a fix.\n\n#eMudhra #Cybersecurity https://t.co/VTxAGHqi6L",
      "date": "2026-10-22T11:42:57.000Z",
      "url": "https://x.com/internetfreedom/status/2113234649258615256",
      "media": [],
      "incident": "emudhra-intermediate-ca-compromise"
    },
    {
      "authorName": "Node.js",
      "handle": "nodejs",
      "avatarUrl": "https://pbs.twimg.com/profile_images/2087612853830258688/JUl27p1E_bigger.jpg",
      "text": "🔐 Node.js security updates are now available!\n\nNew releases for Node.js 22.x, 24.x & 26.x address multiple vulnerabilities, including high-severity issues.\n\nReview the details and update your systems to stay secure.\n\n🔗 https://t.co/W4kfzx5lxz\n\n#NodeJS #Security",
      "date": "2026-10-21T22:39:27.000Z",
      "url": "https://x.com/nodejs/status/2113037478286221570",
      "media": [],
      "incident": "nodejs-october-2026-security-releases"
    },
    {
      "authorName": "International Cyber Digest",
      "handle": "IntCyberDigest",
      "avatarUrl": "https://pbs.twimg.com/profile_images/1831435438562615296/imkSFey2_bigger.jpg",
      "text": "‼️ GoDaddy is revoking 404,607 TLS certificates after a third party flagged that they didn't match its published certificate rules. https://t.co/SoNFcuNmJj",
      "date": "2026-10-21T20:03:00.000Z",
      "url": "https://x.com/IntCyberDigest/status/2112998104030982490",
      "media": [],
      "incident": "godaddy-mass-certificate-revocation-oct-2026"
    },
    {
      "authorName": "Mark Gadala-Maria",
      "handle": "markgadala",
      "avatarUrl": "https://pbs.twimg.com/profile_images/1904279027013001216/STf4Q5To_bigger.jpg",
      "text": "🚨 BREAKING: Node.js just dropped its OWN security bombshell.\n\n4 HIGH-SEVERITY vulnerabilities patched TODAY, including one that could let hackers remotely execute malicious code on vulnerable servers.\n\n→ 10 SECURITY FLAWS were addressed in today's Node.js release, FOUR rated https://t.co/k3Vb8WK1eC",
      "date": "2026-10-21T17:11:48.000Z",
      "url": "https://x.com/markgadala/status/2112955022082207978",
      "media": [],
      "incident": "nodejs-october-2026-security-releases"
    },
    {
      "authorName": "Daily CyberSecurity",
      "handle": "Daily_CyberSec",
      "avatarUrl": "https://pbs.twimg.com/profile_images/2067063139271905280/morJwm3H_bigger.jpg",
      "text": "The Node.js security release fixes 10 flaws, including a Brotli remote code execution bug, CVE-2026-111497. Update to 26.12.1, 24.22.1 or 22.23.4.\n\n#NodeJS #CVE2026111497 #CVE2026105483 #CVE2026106069 #RemoteCodeExecution #TLS #JavaScript #CyberSecurity\nhttps://t.co/2Rmy6FPWq0",
      "date": "2026-10-21T15:49:04.000Z",
      "url": "https://x.com/Daily_CyberSec/status/2112934202412826673",
      "media": [],
      "incident": "nodejs-october-2026-security-releases"
    },
    {
      "authorName": "ET NOW",
      "handle": "ETNOWlive",
      "avatarUrl": "https://pbs.twimg.com/profile_images/1863866767027933184/hC9WqRl-_bigger.jpg",
      "text": "#NewsAlert | MeitY says: Impact of eMudhra incident on Indian websites, apps was limited\n\nEngages stakeholders to resolve eMudhra incident; here are the other key statements👇\n\n@GoI_MeitY https://t.co/qeeVfhni77",
      "date": "2026-10-21T14:32:04.000Z",
      "url": "https://x.com/ETNOWlive/status/2112914822019137966",
      "media": [],
      "incident": "emudhra-intermediate-ca-compromise"
    },
    {
      "authorName": "5h3ll",
      "handle": "social5h3ll",
      "avatarUrl": "https://pbs.twimg.com/profile_images/2098744719451037699/D5xMv_cH_bigger.jpg",
      "text": "Breaking 🚨 - Node.js October 2026 Security Releases – High severity fixes available now! \n\nSecurity updates are out for the supported Node.js lines: 26.x, 24.x, and 22.x.\n\nHighest severity is HIGH. Key issues include:\n•  TLS non-canonical IP address handling (CVE-2026-106069 / https://t.co/npxfOdxGdg",
      "date": "2026-10-21T12:03:43.000Z",
      "url": "https://x.com/social5h3ll/status/2112877488456044609",
      "media": [
        {
          "type": "image",
          "url": "https://pbs.twimg.com/media/HVJy39RW8AApYfx.jpg"
        }
      ],
      "incident": "nodejs-october-2026-security-releases"
    },
    {
      "authorName": "Dark Web Intelligence",
      "handle": "DailyDarkWeb",
      "avatarUrl": "https://pbs.twimg.com/profile_images/1507666522008915969/T-CQnTJy_bigger.jpg",
      "text": "⚠️ UPDATE: eMUDHRA INTERMEDIATE CA PRIVATE KEYS PROVEN COMPROMISED, NOT JUST WEAK\n\nA new disclosure site for the eMudhra (emSign) incident confirms that the private keys of all eight affected intermediate CAs are compromised. To prove it, the original reporter signed a message https://t.co/dh7UYyF5JC",
      "date": "2026-10-20T23:14:17.000Z",
      "url": "https://x.com/DailyDarkWeb/status/2112683854356152830",
      "media": [
        {
          "type": "image",
          "url": "https://pbs.twimg.com/media/HVHCw9TbUAEtlZa.jpg"
        }
      ],
      "incident": "emudhra-intermediate-ca-compromise"
    },
    {
      "authorName": "flow in 🏴‍☠️",
      "handle": "flowirin",
      "avatarUrl": "https://pbs.twimg.com/profile_images/1779389632750428160/DA8czVom_bigger.jpg",
      "text": "The private keys of eight eMudhra intermediate CA certificates have been compromised. \n\nThey chain to roots trusted by the Mozilla, Microsoft, Apple and Chrome root programs and by many downstream trust stores.\n\n eMudhra (Emudhra Limited) is an Indian company.⁠\n\nIt is",
      "date": "2026-10-20T20:31:12.000Z",
      "url": "https://x.com/flowirin/status/2112642813259301083",
      "media": [],
      "incident": "emudhra-intermediate-ca-compromise"
    },
    {
      "authorName": "Dark Web Intelligence",
      "handle": "DailyDarkWeb",
      "avatarUrl": "https://pbs.twimg.com/profile_images/1507666522008915969/T-CQnTJy_bigger.jpg",
      "text": "🚨 WEAK eMUDHRA CA KEYS TRIGGER EMERGENCY TRUST UPDATES ACROSS BROWSERS, GO AND PYTHON\n\nThe private keys of eight eMudhra (emSign) intermediate CA certificates were generated so badly that anyone can recover them. A researcher reported it to the Chrome, Mozilla, Apple and https://t.co/NU2jaFYmzr",
      "date": "2026-10-20T19:14:12.000Z",
      "url": "https://x.com/DailyDarkWeb/status/2112623438049497364",
      "media": [
        {
          "type": "image",
          "url": "https://pbs.twimg.com/media/HVGL0TgbgAAMXNS.jpg"
        }
      ],
      "incident": "emudhra-intermediate-ca-compromise"
    },
    {
      "authorName": "CloudDog",
      "handle": "CloudDogx",
      "avatarUrl": "https://pbs.twimg.com/profile_images/2106561242634825728/kAz3w_Hc_bigger.jpg",
      "text": "8 intermediate CA private keys from eMudhra have been compromised. Reported to Mozilla on Oct 17, browsers started emergency-blocking the certs within hours; Apple and Microsoft followed on the 19th and 20th. Go, Electron, Python certifi, Rust and NSS all pushed fixes. Update",
      "date": "2026-10-20T18:35:18.000Z",
      "url": "https://x.com/CloudDogx/status/2112613648388739471",
      "media": [],
      "incident": "emudhra-intermediate-ca-compromise"
    },
    {
      "authorName": "Charlie Marsh",
      "handle": "charliermarsh",
      "avatarUrl": "https://pbs.twimg.com/profile_images/1490182599981125634/ex0Jezvf_bigger.jpg",
      "text": "We just released uv 0.13.4, which updates our bundled certs in response to the eMudra incident.\n\nThis is a huge deal, and not unique to uv! It affects much of open source due to bundled CAs in certifi, webpki-root-certs, etc. Please upgrade anything that bundles CA certs.",
      "date": "2026-10-20T17:36:56.000Z",
      "url": "https://x.com/charliermarsh/status/2112598956996010030",
      "media": [],
      "incident": "emudhra-intermediate-ca-compromise"
    },
    {
      "authorName": "Xavier Rivera",
      "handle": "XavierRiveraX",
      "avatarUrl": "https://pbs.twimg.com/profile_images/2102132195200479232/2hHv0Px0_bigger.jpg",
      "text": "Eight eMudhra intermediate CA private keys are compromised. They chain to roots trusted by Mozilla, Microsoft, Apple and Chrome, so whoever holds them could impersonate any site.\n\nFirefox, Chrome, Apple and Microsoft already block them. Apps that carry their own CA bundle don't",
      "date": "2026-10-20T14:44:43.000Z",
      "url": "https://x.com/XavierRiveraX/status/2112555618019971544",
      "media": [],
      "incident": "emudhra-intermediate-ca-compromise"
    }
  ],
  "changes": [
    {
      "incident": "emudhra-intermediate-ca-compromise",
      "incidentTitle": "eMudhra intermediate CA private keys compromised",
      "severity": "critical",
      "status": "live",
      "patchStatus": "partial",
      "date": "2026-10-22",
      "title": "Tracker lists patched releases across distros, language runtimes and tools; Bun, Erlang certifi and Bottlerocket still pending. mitmproxy 12.3.0 drops eMudhra CAs.",
      "body": null,
      "sourceUrl": "https://emudhra.we-have-a-problem.com/",
      "url": "https://pwn.watch/i/emudhra-intermediate-ca-compromise"
    },
    {
      "incident": "emudhra-intermediate-ca-compromise",
      "incidentTitle": "eMudhra intermediate CA private keys compromised",
      "severity": "critical",
      "status": "live",
      "patchStatus": "partial",
      "date": "2026-10-22",
      "title": "eMudhra says a flaw in its April 30 2025 key generation ceremony produced a second set of weak keys, and those were the ones published to root stores; root cause still under investigation, replacement certs being issued to customers.",
      "body": null,
      "sourceUrl": "https://www.theregister.com/security/2026/10/22/certification-authority-emudhra-defends-its-laughably-weak-private-keys/5304647",
      "url": "https://pwn.watch/i/emudhra-intermediate-ca-compromise"
    },
    {
      "incident": "emudhra-intermediate-ca-compromise",
      "incidentTitle": "eMudhra intermediate CA private keys compromised",
      "severity": "critical",
      "status": "live",
      "patchStatus": "partial",
      "date": "2026-10-22",
      "title": "Internet Freedom Foundation says it has written to eMudhra, India’s Controller of Certifying Authorities and CERT-In asking for a fix.",
      "body": null,
      "sourceUrl": "https://x.com/internetfreedom/status/2113234649258615256",
      "url": "https://pwn.watch/i/emudhra-intermediate-ca-compromise"
    },
    {
      "incident": "emudhra-intermediate-ca-compromise",
      "incidentTitle": "eMudhra intermediate CA private keys compromised",
      "severity": "critical",
      "status": "live",
      "patchStatus": "partial",
      "date": "2026-10-22",
      "title": "eMudhra's board decides to exit the global SSL/TLS certificate business (about 1% of revenue); existing certificates stay supported until expiry or replacement, revocation and status services stay up, and its Indian DSC and eSign businesses continue.",
      "body": null,
      "sourceUrl": "https://www.moneycontrol.com/technology/emudhra-to-exit-global-website-security-certificate-business-after-key-generation-flaw-article-14057821.html",
      "url": "https://pwn.watch/i/emudhra-intermediate-ca-compromise"
    },
    {
      "incident": "emudhra-intermediate-ca-compromise",
      "incidentTitle": "eMudhra intermediate CA private keys compromised",
      "severity": "critical",
      "status": "live",
      "patchStatus": "partial",
      "date": "2026-10-22",
      "title": "Co-founder Kaushik Srinivasan blames human error and a script failure in the Apr 30 2025 key ceremony (no maker-checker controls), says the eight issuers never issued end-entity certificates and there was no breach; one US customer has about 30,000 certificates on the distrusted ECC chain, while its RSA chain stays trusted.",
      "body": null,
      "sourceUrl": "https://www.tribuneindia.com/news/business/emudhra-attributes-certificate-security-incident-to-human-error-co-founder-says-few-customers-directly-affected/",
      "url": "https://pwn.watch/i/emudhra-intermediate-ca-compromise"
    },
    {
      "incident": "nodejs-october-2026-security-releases",
      "incidentTitle": "Node.js October 2026 security releases (Brotli RCE + TLS/DNS highs)",
      "severity": "high",
      "status": "live",
      "patchStatus": "patched",
      "date": "2026-10-21",
      "title": "Node.js published the Wednesday security releases and advisory.",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/nodejs-october-2026-security-releases"
    },
    {
      "incident": "nodejs-october-2026-security-releases",
      "incidentTitle": "Node.js October 2026 security releases (Brotli RCE + TLS/DNS highs)",
      "severity": "high",
      "status": "live",
      "patchStatus": "patched",
      "date": "2026-10-21",
      "title": "Vercel deployed WAF rules for the Brotli attack vector and began rolling patched runtimes.",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/nodejs-october-2026-security-releases"
    },
    {
      "incident": "emudhra-intermediate-ca-compromise",
      "incidentTitle": "eMudhra intermediate CA private keys compromised",
      "severity": "critical",
      "status": "live",
      "patchStatus": "partial",
      "date": "2026-10-21",
      "title": "eMudhra published statements; Node.js security release refreshed CA store.",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/emudhra-intermediate-ca-compromise"
    },
    {
      "incident": "emudhra-intermediate-ca-compromise",
      "incidentTitle": "eMudhra intermediate CA private keys compromised",
      "severity": "critical",
      "status": "live",
      "patchStatus": "partial",
      "date": "2026-10-21",
      "title": "Oracle and OpenJDK publish CVE-2026-91403 (CVSS 9.1, JSSE): Java updates distrust the eight intermediates; blocked.certs / revocation-check workaround provided.",
      "body": null,
      "sourceUrl": "https://openjdk.org/groups/vulnerability/advisories/2026-10-21",
      "url": "https://pwn.watch/i/emudhra-intermediate-ca-compromise"
    },
    {
      "incident": "emudhra-intermediate-ca-compromise",
      "incidentTitle": "eMudhra intermediate CA private keys compromised",
      "severity": "critical",
      "status": "live",
      "patchStatus": "partial",
      "date": "2026-10-21",
      "title": "India's MeitY forms a special team to probe the incident; says impact on Indian websites and apps was limited.",
      "body": null,
      "sourceUrl": "https://x.com/ETNOWlive/status/2112914822019137966",
      "url": "https://pwn.watch/i/emudhra-intermediate-ca-compromise"
    },
    {
      "incident": "godaddy-mass-certificate-revocation-oct-2026",
      "incidentTitle": "GoDaddy mass-revokes 404,607 TLS certificates over CP/CPS profile mismatch",
      "severity": "medium",
      "status": "live",
      "patchStatus": "partial",
      "date": "2026-10-21",
      "title": "GoDaddy's customer notice says the incorrectly issued certificates were revoked; affected sites must install the re-issued certificate.",
      "body": null,
      "sourceUrl": "https://www.godaddy.com/help/what-is-the-cpcps-certificate-profile-bug-43095",
      "url": "https://pwn.watch/i/godaddy-mass-certificate-revocation-oct-2026"
    },
    {
      "incident": "nginx-october-2026-advisories",
      "incidentTitle": "nginx 1.31.7 / 1.30.6 security fixes (HTTP/3, TLS tickets, overflows)",
      "severity": "medium",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2026-10-21",
      "title": "Security advisories and patched releases published on nginx.org.",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/nginx-october-2026-advisories"
    },
    {
      "incident": "nginx-october-2026-advisories",
      "incidentTitle": "nginx 1.31.7 / 1.30.6 security fixes (HTTP/3, TLS tickets, overflows)",
      "severity": "medium",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2026-10-21",
      "title": "nginx 1.31.8 mainline released.",
      "body": null,
      "sourceUrl": "https://nginx.org/",
      "url": "https://pwn.watch/i/nginx-october-2026-advisories"
    },
    {
      "incident": "emudhra-intermediate-ca-compromise",
      "incidentTitle": "eMudhra intermediate CA private keys compromised",
      "severity": "critical",
      "status": "live",
      "patchStatus": "partial",
      "date": "2026-10-20",
      "title": "Community tracker emudhra.we-have-a-problem.com listed patched software; Alpine/curl/certifi/Go/Electron updates rolled.",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/emudhra-intermediate-ca-compromise"
    },
    {
      "incident": "emudhra-intermediate-ca-compromise",
      "incidentTitle": "eMudhra intermediate CA private keys compromised",
      "severity": "critical",
      "status": "live",
      "patchStatus": "partial",
      "date": "2026-10-20",
      "title": "Python: certifi 2026.10.18 drops all emSign roots (GHSA-6q48-6c7w-9gw2, CVSS 7.4); 2026.10.19 restores the unaffected ones. pip 26.2.2 vendors the new certifi and uv 0.13.4 refreshes its bundled Mozilla roots (GHSA-hq85-5cpj-mr62).",
      "body": null,
      "sourceUrl": "https://advisories.gitlab.com/pypi/certifi/GHSA-6q48-6c7w-9gw2/",
      "url": "https://pwn.watch/i/emudhra-intermediate-ca-compromise"
    },
    {
      "incident": "emudhra-intermediate-ca-compromise",
      "incidentTitle": "eMudhra intermediate CA private keys compromised",
      "severity": "critical",
      "status": "live",
      "patchStatus": "partial",
      "date": "2026-10-20",
      "title": "Python Software Foundation's Seth Larson tells Python users to upgrade certifi 2026.10.19, pip 26.2.2, uv 0.13.4, sigstore 4.5.1, conda 26.9.4 and pixi 0.82.1 in every venv and rebuild container images. pip below 26.2.2 keeps trusting the bad CAs through its vendored certifi even if the OS store is fixed, so pip itself has to be upgraded.",
      "body": null,
      "sourceUrl": "https://discuss.python.org/t/information-for-python-users-regarding-emudhra-emsign-ca-certificate-security-incident/109576",
      "url": "https://pwn.watch/i/emudhra-intermediate-ca-compromise"
    },
    {
      "incident": "emudhra-intermediate-ca-compromise",
      "incidentTitle": "eMudhra intermediate CA private keys compromised",
      "severity": "critical",
      "status": "live",
      "patchStatus": "partial",
      "date": "2026-10-19",
      "title": "eMudhra revoked the eight intermediates; browsers continued emergency distrust.",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/emudhra-intermediate-ca-compromise"
    },
    {
      "incident": "godaddy-mass-certificate-revocation-oct-2026",
      "incidentTitle": "GoDaddy mass-revokes 404,607 TLS certificates over CP/CPS profile mismatch",
      "severity": "medium",
      "status": "live",
      "patchStatus": "partial",
      "date": "2026-10-19",
      "title": "227,422 of 404,607 certificates revoked as of 05:29 UTC.",
      "body": null,
      "sourceUrl": "https://bugzilla.mozilla.org/show_bug.cgi?id=2083191",
      "url": "https://pwn.watch/i/godaddy-mass-certificate-revocation-oct-2026"
    },
    {
      "incident": "emudhra-intermediate-ca-compromise",
      "incidentTitle": "eMudhra intermediate CA private keys compromised",
      "severity": "critical",
      "status": "live",
      "patchStatus": "partial",
      "date": "2026-10-18",
      "title": "Independent researcher reported weak/compromisable eMudhra intermediate keys to Apple, Google, Microsoft and Mozilla.",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/emudhra-intermediate-ca-compromise"
    },
    {
      "incident": "godaddy-mass-certificate-revocation-oct-2026",
      "incidentTitle": "GoDaddy mass-revokes 404,607 TLS certificates over CP/CPS profile mismatch",
      "severity": "medium",
      "status": "live",
      "patchStatus": "partial",
      "date": "2026-10-18",
      "title": "Five-day revocation deadline (23:45 UTC) passes with 170,566 certificates revoked; GoDaddy files a delayed-revocation incident.",
      "body": null,
      "sourceUrl": "https://bugzilla.mozilla.org/show_bug.cgi?id=2083191",
      "url": "https://pwn.watch/i/godaddy-mass-certificate-revocation-oct-2026"
    },
    {
      "incident": "godaddy-mass-certificate-revocation-oct-2026",
      "incidentTitle": "GoDaddy mass-revokes 404,607 TLS certificates over CP/CPS profile mismatch",
      "severity": "medium",
      "status": "live",
      "patchStatus": "partial",
      "date": "2026-10-14",
      "title": "GoDaddy confirms a third-party report of CP/CPS discrepancies, suspends issuance, fixes its CP/CPS and starts contacting the 404,607 affected subscribers.",
      "body": null,
      "sourceUrl": "https://bugzilla.mozilla.org/show_bug.cgi?id=2083191",
      "url": "https://pwn.watch/i/godaddy-mass-certificate-revocation-oct-2026"
    },
    {
      "incident": "nginx-october-2026-advisories",
      "incidentTitle": "nginx 1.31.7 / 1.30.6 security fixes (HTTP/3, TLS tickets, overflows)",
      "severity": "medium",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2026-10-14",
      "title": "nginx 1.30.6 stable and 1.31.7 mainline released with fixes for CVE-2026-15176, -93479, -95101, -97629, -97205; njs 1.0.2 fixes CVE-2026-101025.",
      "body": null,
      "sourceUrl": "https://nginx.org/",
      "url": "https://pwn.watch/i/nginx-october-2026-advisories"
    }
  ]
}