Weak eMudhra certificate keys prompt browser blocks and Go fixes

In an October 21 advisory, Cisco Talos reported eight compromised eMudhra intermediate certificates whose weak private keys were trivial to recover. Talos traced the problem to an April 2025 key-generation process. It said browser vendors had blocked six TLS certificates, Microsoft had blocked two code-signing certificates, and eMudhra had revoked the certificates.

The practical concern extends beyond the browser’s front door. Talos says an attacker intercepting or redirecting a connection could impersonate a server if the client still trusts an affected key and applicable protections do not block it. Applications with separate trust stores or limited revocation checking, including some VPN and embedded deployments, may remain exposed.

For Go, Talos reports that versions 1.27.3 and 1.26.10 address CVE-2026-111943 by filtering certificate chains containing the eight affected public-key hashes. It recommends updating affected software and trust stores as vendor fixes become available. Talos said it had observed no malicious incidents involving these certificates as of October 21 at 14:00 UTC.