TL;DR

what: The private keys for eight eMudhra emSign intermediate CA certificates were generated with too little randomness, so anyone could compute them from the public certificates.

impact: Anyone holding the keys could issue TLS certificates for any website, or code-signing certificates, that clients chaining to emSign ECC Root CA - G3 or the Sectigo cross-signs would accept.

fix: Chrome, Firefox, Apple, Microsoft and Android pushed blocks between October 17 and 20, and Go 1.27.3 and 1.26.10 (CVE-2026-111943), Firefox 158.0.1 (CVE-2026-113470), NSS 3.131.1, certifi 2026.10.19 and webpki-roots 1.0.10 remove or reject the affected trust.

who: Organizations running Go binaries, Python services on certifi, Rust services on webpki-roots, Apple devices trusting Sectigo AAA Certificate Services, and any client that does not check revocation.

Eight intermediate certificate authority keys belonging to eMudhra, the Indian CA that sells certificates under the emSign brand, are compromised.…