pwn.watch: TLS incident updates https://pwn.watch/t/tls Live security incidents worldwide: CVEs, patch status, fixed versions, advisories and the posts that broke them. en Thu, 22 Oct 2026 16:23:59 GMT [critical] eMudhra intermediate CA private keys compromised: Tracker lists patched releases across distros, language runtimes and tools; Bun, Erlang certifi and Bottlerocket still pending. mitmproxy 12.3.0 drops eMudhra CAs. https://pwn.watch/i/emudhra-intermediate-ca-compromise emudhra-intermediate-ca-compromise:2026-10-22:Tracker lists patched releases across distros, language runtimes and tools; Bun, Erlang certifi and Bottlerocket still pending. mitmproxy 12.3.0 drops eMudhra CAs. Thu, 22 Oct 2026 00:00:00 GMT critical Source: https://emudhra.we-have-a-problem.com/ Status: live, partial [critical] eMudhra intermediate CA private keys compromised: eMudhra says a flaw in its April 30 2025 key generation ceremony produced a second set of weak keys, and those were the ones published to root stores; root cause still under investigation, replacement certs being issued to customers. https://pwn.watch/i/emudhra-intermediate-ca-compromise emudhra-intermediate-ca-compromise:2026-10-22:eMudhra says a flaw in its April 30 2025 key generation ceremony produced a second set of weak keys, and those were the ones published to root stores; root cause still under investigation, replacement certs being issued to customers. Thu, 22 Oct 2026 00:00:00 GMT critical Source: https://www.theregister.com/security/2026/10/22/certification-authority-emudhra-defends-its-laughably-weak-private-keys/5304647 Status: live, partial [critical] eMudhra intermediate CA private keys compromised: Internet Freedom Foundation says it has written to eMudhra, India’s Controller of Certifying Authorities and CERT-In asking for a fix. https://pwn.watch/i/emudhra-intermediate-ca-compromise emudhra-intermediate-ca-compromise:2026-10-22:Internet Freedom Foundation says it has written to eMudhra, India’s Controller of Certifying Authorities and CERT-In asking for a fix. Thu, 22 Oct 2026 00:00:00 GMT critical Source: https://x.com/internetfreedom/status/2113234649258615256 Status: live, partial [critical] eMudhra intermediate CA private keys compromised: eMudhra's board decides to exit the global SSL/TLS certificate business (about 1% of revenue); existing certificates stay supported until expiry or replacement, revocation and status services stay up, and its Indian DSC and eSign businesses continue. https://pwn.watch/i/emudhra-intermediate-ca-compromise emudhra-intermediate-ca-compromise:2026-10-22:eMudhra's board decides to exit the global SSL/TLS certificate business (about 1% of revenue); existing certificates stay supported until expiry or replacement, revocation and status services stay up, and its Indian DSC and eSign businesses continue. Thu, 22 Oct 2026 00:00:00 GMT critical Source: https://www.moneycontrol.com/technology/emudhra-to-exit-global-website-security-certificate-business-after-key-generation-flaw-article-14057821.html Status: live, partial [critical] eMudhra intermediate CA private keys compromised: Co-founder Kaushik Srinivasan blames human error and a script failure in the Apr 30 2025 key ceremony (no maker-checker controls), says the eight issuers never issued end-entity certificates and there was no breach; one US customer has about 30,000 certificates on the distrusted ECC chain, while its RSA chain stays trusted. https://pwn.watch/i/emudhra-intermediate-ca-compromise emudhra-intermediate-ca-compromise:2026-10-22:Co-founder Kaushik Srinivasan blames human error and a script failure in the Apr 30 2025 key ceremony (no maker-checker controls), says the eight issuers never issued end-entity certificates and there was no breach; one US customer has about 30,000 certificates on the distrusted ECC chain, while its RSA chain stays trusted. Thu, 22 Oct 2026 00:00:00 GMT critical Source: https://www.tribuneindia.com/news/business/emudhra-attributes-certificate-security-incident-to-human-error-co-founder-says-few-customers-directly-affected/ Status: live, partial [high] Node.js October 2026 security releases (Brotli RCE + TLS/DNS highs): Node.js published the Wednesday security releases and advisory. https://pwn.watch/i/nodejs-october-2026-security-releases nodejs-october-2026-security-releases:2026-10-21:Node.js published the Wednesday security releases and advisory. Wed, 21 Oct 2026 00:00:00 GMT high Status: live, patched [high] Node.js October 2026 security releases (Brotli RCE + TLS/DNS highs): Vercel deployed WAF rules for the Brotli attack vector and began rolling patched runtimes. https://pwn.watch/i/nodejs-october-2026-security-releases nodejs-october-2026-security-releases:2026-10-21:Vercel deployed WAF rules for the Brotli attack vector and began rolling patched runtimes. Wed, 21 Oct 2026 00:00:00 GMT high Status: live, patched [critical] eMudhra intermediate CA private keys compromised: eMudhra published statements; Node.js security release refreshed CA store. https://pwn.watch/i/emudhra-intermediate-ca-compromise emudhra-intermediate-ca-compromise:2026-10-21:eMudhra published statements; Node.js security release refreshed CA store. Wed, 21 Oct 2026 00:00:00 GMT critical Status: live, partial [critical] eMudhra intermediate CA private keys compromised: Oracle and OpenJDK publish CVE-2026-91403 (CVSS 9.1, JSSE): Java updates distrust the eight intermediates; blocked.certs / revocation-check workaround provided. https://pwn.watch/i/emudhra-intermediate-ca-compromise emudhra-intermediate-ca-compromise:2026-10-21:Oracle and OpenJDK publish CVE-2026-91403 (CVSS 9.1, JSSE): Java updates distrust the eight intermediates; blocked.certs / revocation-check workaround provided. Wed, 21 Oct 2026 00:00:00 GMT critical Source: https://openjdk.org/groups/vulnerability/advisories/2026-10-21 Status: live, partial [critical] eMudhra intermediate CA private keys compromised: India's MeitY forms a special team to probe the incident; says impact on Indian websites and apps was limited. https://pwn.watch/i/emudhra-intermediate-ca-compromise emudhra-intermediate-ca-compromise:2026-10-21:India's MeitY forms a special team to probe the incident; says impact on Indian websites and apps was limited. Wed, 21 Oct 2026 00:00:00 GMT critical Source: https://x.com/ETNOWlive/status/2112914822019137966 Status: live, partial [medium] GoDaddy mass-revokes 404,607 TLS certificates over CP/CPS profile mismatch: GoDaddy's customer notice says the incorrectly issued certificates were revoked; affected sites must install the re-issued certificate. https://pwn.watch/i/godaddy-mass-certificate-revocation-oct-2026 godaddy-mass-certificate-revocation-oct-2026:2026-10-21:GoDaddy's customer notice says the incorrectly issued certificates were revoked; affected sites must install the re-issued certificate. Wed, 21 Oct 2026 00:00:00 GMT medium Source: https://www.godaddy.com/help/what-is-the-cpcps-certificate-profile-bug-43095 Status: live, partial [medium] nginx 1.31.7 / 1.30.6 security fixes (HTTP/3, TLS tickets, overflows): Security advisories and patched releases published on nginx.org. https://pwn.watch/i/nginx-october-2026-advisories nginx-october-2026-advisories:2026-10-21:Security advisories and patched releases published on nginx.org. Wed, 21 Oct 2026 00:00:00 GMT medium Status: closed, patched [medium] nginx 1.31.7 / 1.30.6 security fixes (HTTP/3, TLS tickets, overflows): nginx 1.31.8 mainline released. https://pwn.watch/i/nginx-october-2026-advisories nginx-october-2026-advisories:2026-10-21:nginx 1.31.8 mainline released. Wed, 21 Oct 2026 00:00:00 GMT medium Source: https://nginx.org/ Status: closed, patched [critical] eMudhra intermediate CA private keys compromised: Community tracker emudhra.we-have-a-problem.com listed patched software; Alpine/curl/certifi/Go/Electron updates rolled. https://pwn.watch/i/emudhra-intermediate-ca-compromise emudhra-intermediate-ca-compromise:2026-10-20:Community tracker emudhra.we-have-a-problem.com listed patched software; Alpine/curl/certifi/Go/Electron updates rolled. Tue, 20 Oct 2026 00:00:00 GMT critical Status: live, partial [critical] eMudhra intermediate CA private keys compromised: eMudhra revoked the eight intermediates; browsers continued emergency distrust. https://pwn.watch/i/emudhra-intermediate-ca-compromise emudhra-intermediate-ca-compromise:2026-10-19:eMudhra revoked the eight intermediates; browsers continued emergency distrust. Mon, 19 Oct 2026 00:00:00 GMT critical Status: live, partial [medium] GoDaddy mass-revokes 404,607 TLS certificates over CP/CPS profile mismatch: 227,422 of 404,607 certificates revoked as of 05:29 UTC. https://pwn.watch/i/godaddy-mass-certificate-revocation-oct-2026 godaddy-mass-certificate-revocation-oct-2026:2026-10-19:227,422 of 404,607 certificates revoked as of 05:29 UTC. Mon, 19 Oct 2026 00:00:00 GMT medium Source: https://bugzilla.mozilla.org/show_bug.cgi?id=2083191 Status: live, partial [critical] eMudhra intermediate CA private keys compromised: Independent researcher reported weak/compromisable eMudhra intermediate keys to Apple, Google, Microsoft and Mozilla. https://pwn.watch/i/emudhra-intermediate-ca-compromise emudhra-intermediate-ca-compromise:2026-10-18:Independent researcher reported weak/compromisable eMudhra intermediate keys to Apple, Google, Microsoft and Mozilla. Sun, 18 Oct 2026 00:00:00 GMT critical Status: live, partial [medium] GoDaddy mass-revokes 404,607 TLS certificates over CP/CPS profile mismatch: Five-day revocation deadline (23:45 UTC) passes with 170,566 certificates revoked; GoDaddy files a delayed-revocation incident. https://pwn.watch/i/godaddy-mass-certificate-revocation-oct-2026 godaddy-mass-certificate-revocation-oct-2026:2026-10-18:Five-day revocation deadline (23:45 UTC) passes with 170,566 certificates revoked; GoDaddy files a delayed-revocation incident. Sun, 18 Oct 2026 00:00:00 GMT medium Source: https://bugzilla.mozilla.org/show_bug.cgi?id=2083191 Status: live, partial [medium] GoDaddy mass-revokes 404,607 TLS certificates over CP/CPS profile mismatch: GoDaddy confirms a third-party report of CP/CPS discrepancies, suspends issuance, fixes its CP/CPS and starts contacting the 404,607 affected subscribers. https://pwn.watch/i/godaddy-mass-certificate-revocation-oct-2026 godaddy-mass-certificate-revocation-oct-2026:2026-10-14:GoDaddy confirms a third-party report of CP/CPS discrepancies, suspends issuance, fixes its CP/CPS and starts contacting the 404,607 affected subscribers. Wed, 14 Oct 2026 00:00:00 GMT medium Source: https://bugzilla.mozilla.org/show_bug.cgi?id=2083191 Status: live, partial [medium] nginx 1.31.7 / 1.30.6 security fixes (HTTP/3, TLS tickets, overflows): nginx 1.30.6 stable and 1.31.7 mainline released with fixes for CVE-2026-15176, -93479, -95101, -97629, -97205; njs 1.0.2 fixes CVE-2026-101025. https://pwn.watch/i/nginx-october-2026-advisories nginx-october-2026-advisories:2026-10-14:nginx 1.30.6 stable and 1.31.7 mainline released with fixes for CVE-2026-15176, -93479, -95101, -97629, -97205; njs 1.0.2 fixes CVE-2026-101025. Wed, 14 Oct 2026 00:00:00 GMT medium Source: https://nginx.org/ Status: closed, patched