Mozilla and Google's Chrome Root Program confirmed on October 20 that the private keys behind eight eMudhra intermediate certificate authority certificates have been exposed, meaning anyone holding them could forge a trusted certificate for almost any website. The discovery, credited to an independent researcher, triggered emergency responses across the industry: Go's maintainers shipped point releases 1.27.3 and 1.26.10 that reject certificate chains tied to those keys. Browser vendors are rolling out similar blocks while the affected certificate authority works through its own fixes.
// source: thehackernews.com ↗