eMudhra says weak keys left eight emSign G3 CA keys recoverable
Browsers are phasing out emSign G1 trust in November 2026; eMudhra says the G3 intermediates issued no public end-entity certificates.
Stories per day · 30 days
10 RSS
Relatedemudhra32certificate-authority27pki16openssl11post-quantum10brotli7certificates7code-signing6dns6firefox6go6goahead6nodejs6chrome4cryptography4embedthis4ml-kem4weak-keys4
147 stories, newest first · one card per story
Stories tagged #tls
CPython skips server identity checks in ssl.get_server_certificate
Python rates CVE-2026-19552 low: with ca_certs set, the call checks the chain but not the server identity.
The race to secure record-like information for domains
Signed MX adoption is 12.3% in the Tranco top 1,000 and 1.4% of .COM, so apps cannot assume DNSSEC.
ESP32-S3 workers share chaotic image encryption over Wi-Fi
Four workers cut runtime from 43.215 to 15.878 seconds, a 2.72 times speed-up, with entropy 7.999940 bits/byte.
arXiv study assesses post-quantum cryptography adoption in TLS
PQC support reaches only 9.1% for HTTPS and below 1% for other protocols at server level.
Node.js schedules security fixes for 22.x 24.x and 26.x lines
Node.js will release high-severity patches for supported 22.x 24.x and 26.x branches on or after November 11 2026 following earlier TLS DNS and Brotli fixes.
1
Ghostunnel open-source TLS proxy supports mutual authentication
Ghostunnel enables plaintext services to use mutual TLS without code changes via SPIFFE IDs and Open Policy Agent policies.
BaseChat Android app has TLS, data mapping, and log vulnerabilities
The app fails to validate TLS certificates, maps users via phone numbers, and logs PII in production builds.
Certificate Validation Flaw in LXD and Incus Allows Unauthenticated Host Control
The flaw lets attackers impersonate trusted certificates during TLS handshakes to bypass authentication in LXD and Incus clusters.
LXD and MicroCloud Flaw Lets Attackers Impersonate Trusted Clients (CVE-2026-112816)
CVSS 10.0 flaw in mutual TLS certificate validation lets attackers impersonate trusted clients without private key; fixed in LXD 6.10.1 and MicroCloud 3.4.1.
1
Bunny CDN isolates Armenia node after provider reports unauthorized access
Investigators found no access to the node, but Bunny is reissuing TLS certificates in case cached content or keys were exposed.
Cloudflare tracks forged certificates from eMudhra’s weak CA keys
About 22,000 handshakes presented the weak keys; Cloudflare says none intercepted its own connections.
1
Sectigo survey finds TLS renewal confidence outruns automation
Of 500 leaders, 61% reported a certificate incident in the past year, while only 4% automate more than 90% of renewals.
Qpid Proton C OpenSSL APIs keep default trust anchors (CVE-2026-105031)
pn_ssl_domain_set_trusted_ca_db() and pn_tls_config_set_trusted_certs() add CAs instead of replacing system anchors.
Cisco warns October 2026 Node.js flaws can enable RCE
High-SIR issues include a Brotli out-of-bounds write and DNS truncation with an embedded NUL; fixes cover 22.x, 24.x, and 26.x.
GoAhead TLS flaws can ignore CRLs, weaken encryption, or bypass chain limits
FoxIO published PoCs for three configuration-specific bugs; GoAhead 6.1.1 fixes the OpenSSL and Mbed TLS issues.
Microsoft revokes trust in compromised eMudhra certificates
An October 26 Windows update drops seven certificates after weak key generation exposed eight eMudhra intermediate keys.
GoAhead CRL check skip lets revoked client certificates pass mutual TLS
CVE-2026-115881 scores 9.1 on GoAhead 3.4.5–6.1.0 with mutual TLS and a loaded CRL; 6.1.1 fixes it.
NIST sets 2030 and 2035 dates to drop quantum-vulnerable crypto
Prioritized federal systems must use quantum-resistant key establishment by the end of 2030 and signatures by the end of 2031.
3
GoAhead before 6.1.1 has three TLS bugs in crypto backends
A foxio.io write-up covers flaws in GoAhead's OpenSSL, LibreSSL, and Mbed TLS code; the note omits the details.
October 2026 Node.js flaws affect Cisco products, Cisco says
High-rated issues include a Brotli out-of-bounds write that could allow remote code execution.
Three GoAhead TLS bugs skip CRLs, depth limits, or weaken DH
Fixes are in GoAhead 6.1.1 for the OpenSSL-compatible and mbed TLS cases; a public PoC decrypts weak DHE sessions.
Microsoft Windows updates remove trust in weak eMudhra certificates
October 26 updates target offline Windows systems after eight April 2025 intermediate keys proved recoverable.
GoAhead 6.1.1 fixes three TLS flaws in embedded web servers
A critical OpenSSL-backend bug can accept revoked client certificates; the other flaws weaken DHE or chain checks.