Azure Linux 3.0.2022 bundles more than 470 CVE fixes
The kernel moves to 6.6.161.1, and Microsoft distrusts certificates tied to the eMudhra incident.
Stories per day · 30 days
1 RSS
Relatedemudhra9tls7ccadb2go2java2mozilla2pki2spki2alpine1azure-linux1badkeys1brotli1clickfix1code-signing1comodo1containerd1deno1denylist1
31 stories, newest first · one card per story
Stories tagged #certificates
Microsoft revokes trust in compromised eMudhra certificates
An October 26 Windows update drops seven certificates after weak key generation exposed eight eMudhra intermediate keys.
Malwarebytes warns of ClickFix lures amid PHP, Brotli and certificate issues
The piece says attackers exploited two unnamed PHP flaws and that browsers have blocked eight bad certificates.
Java fingerprint blocklist misses re-encoded eMudhra certificates
Re-encoded ECDSA and RSA intermediates still validated in tested JDKs after blocked.certs rejected the original encodings.
1
Python ssl module denylists compromised intermediates (CVE-2026-115557)
The notice says the denylist should protect users even when those certificates are not yet removed elsewhere.
Oracle emergency Java update distrusts weak eMudhra CAs (CVE-2026-91403)
The CVSS 9.1 JSSE flaw can let an on-path attacker forge trusted hostnames; no attacks are confirmed.
Comodo AAA Services root and S/MIME raised on oss-security
The October 22 post is truncated after Böck says he asked Mozilla what earlier messages meant.
mitmproxy commit adds an --emudhra option
The Hacker News post shows only a score of 42 points and eight comments, with no description of the flag.
badkeys author says he already scans CCADB certs for weak keys
Hanno Böck has not yet added checks for small ECDSA keys and plans a later write-up.
uv, Deno and Alpine packages bundle webpki root certificates
An Alpine edge SBOM check found 29 community and 41 testing packages potentially affected.
Eight eMudhra TLS certificates had private keys of 3 to 8 bits
The private keys were the integers 4, 56, 66, 115, 155, 156, 230 and 237, versus a normal P-384 key.
Mozilla blocks eight compromised eMudhra intermediate certificates
OneCRL reached standard Firefox users in under three hours; 158.0.1 and two ESR builds cover the rest.
Go will reject certificate chains with eight distrusted SPKIs
A reader of the change says 16 certificates, all from eMudhra, appear to match.
Go will reject certificate chains containing eight distrusted SPKIs
The Hacker News item only shows 29 points and six comments, with no keys or versions.
Let’s Encrypt Cuts Default Certificate Validity to 64 Days Ahead of 45-Day Switch
Let's Encrypt will issue 64-day certificates by default from February 10, 2027, ahead of planned 45-day validity in 2028.
2
Let’s Encrypt TLS certificate lifetimes to drop from 90 to 64 days starting February 2027
Let’s Encrypt will issue 64-day TLS certificates by default from February 10, 2027, down from 90 days.
1
Microsoft: Outdated Windows devices will stop receiving security updates
Unsupported Windows devices will lose security updates after Windows Update certificates expire in 2027.
Let’s Encrypt Cuts TLS Certificate Lifetimes From 90 to 64 Days Starting February 2027
Let's Encrypt will cut default TLS certificate lifetimes from 90 to 64 days on February 10, 2027.
1
Microsoft Says PKI, HSMs and Security Appliances Must Prepare for Post-Quantum Authentication
Microsoft urges teams to test PKI, HSMs, and appliances for post-quantum certificate authentication.
4
Microsoft Pushes Enterprises to Test Post-Quantum Certificates Before Large-Scale Migration
Microsoft's post-quantum TLS pilot asks enterprises to test ML-DSA certificates before production migration.
6
Post-quantum authentication: Why organizations should start testing certificate ecosystems now
Microsoft urges organizations to inventory and test certificate systems now for post-quantum authentication using its PQC TLS pilot.
8
Let's Encrypt cuts certificate lifetimes to 64 days starting February 2027
Let's Encrypt will shorten TLS certificate lifetimes from 90 to 64 days starting February 10, 2027.
64-Day Certificate Lifetimes Coming Feb 2027
Let's Encrypt will default to 64-day certificates on February 10, 2027.
2
Attackers hijack country-code domains to impersonate Google and other services
Attackers hijacked .gh, .sl, and .as DNS to get certificates impersonating Google and others.
4