CVE-2026-111943: Compromised Intermediate Certificate Authority

imeron

It's down for me, are they on PHP? :D

keks24

Gentoo Linux users are adviced to update the package "app-misc/ca-certificates" to version "20260816.3.125" or higher!: # emerge --sync # emerge --ask --oneshot --verbose ">=app-misc/ca-certificates-20260816.3.125" To check via "curl": $ curl --url="https://dv-g3b-emudhra.we-have-a-problem.com/" $ curl --url="https://dv-g3b-aaa-emudhra.we-have-a-problem.com/" They should return: curl: (60) SSL certificate OpenSSL verify result: unable to get local issuer certificate (20) More details here: https://curl.se/docs/sslcerts.html curl failed to verify the legitimacy of the server and therefore could not establish a secure connection to it. To learn more about this situation and how to fix it, please visit the webpage mentioned above. --- * GLSA 202610-01: https://security.gentoo.org/glsa/202610-01 * https://emudhra.we-have-a-problem.com/

asqueella

This seems to be about ‘go’ proactively blocking emudhra certs even though the system trust store is out of date? https://pkg.go.dev/vuln/GO-2026-6809

zkmon

Great. The technology has progressed enough to kill the existing technologies. It's like the fish in a pool creating a shark that eats away all the fish while the fish proudly announce that their great creation (shark) as the frontier progress for their fish race.

galadran

https://emudhra.we-have-a-problem.com/

colinmarc

TL;DR: The very urgent uv/certifi/etc releases (and yet-to-be-done bun release) are about removing the compromised CAs as described here: https://emudhra.we-have-a-problem.com/ In other words, that software bundled the compromised certs into the binary, so upgrading it is the only way to remove them. This is about Go proactively blocking intermediates. Which shouldn't strictly be necessary as long as your OS has removed or distrusted the CAs (on my laptop, macOS has done that, although it seems like it did so in a way not all tools have access to; for example, rustls-platform-verifier respects it, but rustls-webpki still loads the bad CAs from the system trust store). edit: forgot I can't use code blocks on HN

speedgoose

Cock-up or conspiracy?

dathinab

It's a bit surprising that this took ~1.5days to end up on HN.

darkwater

This is news for NIST but old news generally speaking, being the eMudhra debacle. Or am I missing something?

alt227

Im guessing this only affects Go? But I am guessing that from the nist page as none of the headlines mention it at all.

couldbe

Literally xkcd random number. https://xkcd.com/221

contingencies

Fix for OSX - put this in ~/.zshrc: export CURL_CA_BUNDLE="$(brew --prefix)/etc/ca-certificates/cert.pem" To verify, log in to a new shell and run curl https://dv-g3b-emudhra.we-have-a-problem.com/

charlieyu1

We are in the era of 6 digit CVE now

vanschelven

Yesterday's discussion: https://news.ycombinator.com/item?id=50166579

accountrequired

Related (2 days ago): https://news.ycombinator.com/item?id=50160877

vanschelven

Python users may need to take their own separate steps, see this discussion: https://discuss.python.org/t/information-for-python-users-re...

pelzatessa

Worth noting that people on RedHat still haven't received proper updates, only a workaround that disables two Comodo root certificates that were used to sign the emudhra certificates. https://access.redhat.com/security/vulnerabilities/RHSB-2026... - "Ongoing"

freakynit

eMudhra 1FA OTP Login Bypass: https://mastodon.catgirl.cloud/@49016/117475921584308861

jmclnx

Slackware also updated ca-certificates yesterday (Wed Oct 21 00:53:24 UTC 2026). The curl commands keks24 mentioned fails as expected https://ftp.osuosl.org/pub/slackware/slackware64-15.0/Change... To check, from keks24: % curl --url="https://dv-g3b-emudhra.we-have-a-problem.com/" % curl --url="https://dv-g3b-aaa-emudhra.we-have-a-problem.com/"

mort96

What's this link doing here? This page is about the Go update which rejects the bad certificates if they exist in the system trust store