CVE-2026-111943 was disclosed, describing a compromised intermediate certificate authority linked to private-key exposure at Indian certification authority eMudhra.

Hacker News, The Register · AI & Technology

22 Oct 2026

What it means

This is a disclosure that the private keys of eight (CA) certificates issued by the Indian CA eMudhra were compromised. An attacker with these keys can impersonate any website or service, breaking the trust model of HTTPS. The vulnerability is tracked as CVE-2026-111943, and the fix involves adding a in Go's library to reject these compromised certificates.

Accuracy & sourcesSourced

The claim is solid, originating from the official CVE entry and corroborated by multiple security vendors (Cisco Talos, Mozilla, Google, Apple) who have published detailed analyses and taken blocking actions. The reporting sits close to the primary source—the CVE itself and the browser vendor advisories.

How new

Genuinely new: the CVE was published and the compromise disclosed within the past two days (October 2026).