Go 1.27.4 and 1.26.11 released with 12 security fixes
The forwarded note only begins a net/http HTTP/1 server issue and does not list the other fixes.
Stories per day · 30 days
3 RSS
Relatedtls6emudhra4certificate-authority3certificates2pki2spki2access-control1ca-certificates1ccadb1code-signing1crypto-x5091cyber-centre1firefox1idna1kernel1linux1net-http1punycode1
19 stories, newest first · one card per story
Stories tagged #go
Linux before several 5.x–7.x releases affected by CVE-2026-98432
Canada’s Cyber Centre urges administrators to review the linked material and apply updates when available.
webframe executes a web page like a program in a system browser
Jeff Lindsay's Go tool uses glaze and the host browser, and was tested as a scraper and sandbox.
Mozilla, Google and Apple block compromised eMudhra certificates
Eight April 2025 intermediates used private keys smaller than 256; no abuse is evidenced, but many trust stores needed updates.
Tech giants block eMudhra certificates tied to 8 compromised keys
Six keys issued website TLS certificates and two were for code signing; fraudulent issuance is unconfirmed.
1
Go 1.27.3 and Go 1.26.10 released for CA certificate removal
The forwarded note cites crypto/x509; the snippet does not name the removed certificate.
Go 1.27.3 and 1.26.10 block eight CA keys
Rebuilt Go programs reject chains through the keys, with no disable switch, and older unsupported releases get no fix.
4
Go will reject certificate chains with eight distrusted SPKIs
A reader of the change says 16 certificates, all from eMudhra, appear to match.
Go will reject certificate chains containing eight distrusted SPKIs
The Hacker News item only shows 29 points and six comments, with no keys or versions.
USN-8883-2: Go vulnerability
Ubuntu fixes a Go 1.23 x/net/idna Punycode flaw that could bypass hostname access controls.
USN-8914-1: Google Guest Agent, Google OS Config Agent vulnerability
Ubuntu USN-8914-1 patches Punycode handling in Google Guest Agent and OS Config Agent that allowed hostname access-control bypass and privilege escalation.
What makes some open source updates so difficult?
Google found a 2.2-hour median effort for internal open-source updates, with local patches tripling that time.
5
Fwd: Go 1.27.2 and Go 1.26.9 are released
Go released 1.27.2 and 1.26.9 with security fixes, including an HTTP/2 net/http server issue.
USN-8900-1: Go Networking vulnerabilities
Ubuntu patches Go networking flaws that can hang HTTP/2 connections or exhaust resources via HPACK.
USN-8883-1: Go vulnerability
Ubuntu fixed a Go x/net/idna flaw that can bypass hostname controls via Punycode labels.
Show HN: Janus – Go binary that runs GGUF models via Vulkan on AMD/Intel/Nvidia
Janus is a Go binary that runs GGUF models on AMD, Intel, and Nvidia GPUs via Vulkan.
Attackers Use Malicious Terraform Providers to Deliver Go Malware via HashiCorp Registry
DPRK-linked actors planted Go malware in HashiCorp Terraform providers and Go modules.
Agent-net Open Sources Webagent: A Go Harness That Turns Any Website into a Guarded AI Agent
Agent-net open-sourced Webagent, a Go harness turning websites into AI agents with code-enforced guardrails wrapping every tool call.
Signing TLS handshakes inside a TPM
Blog post demonstrates signing TLS handshakes in Go with a TPM-held private key; full text was unavailable behind an Anubis challenge.