#tls
-
Key “4”: Cloudflare measures how much of the Internet still trusts eMudhra’s weak keys
Certificate authority eMudhra issued intermediate keys that can be recovered from public certificates almost instantly. Cloudflare explains how it patched its own systems, what it knows about exploitation attempts, and how many clients remain exposed.
-
Microsoft ships out-of-band Windows updates to distrust eMudhra certificates
The KB5134133 and KB5134125 out-of-band updates remove seven certificates tied to eMudhra's compromised certificate authority keys from the Windows trust list. They target systems that don't receive automatic trust list updates.
-
Indian government sites keep serving revoked eMudhra certificates
After eMudhra's certificate-authority infrastructure was compromised, officials said the impact was very limited. A researcher shows that 156 government sites are still serving revoked certificates days later.
-
OpenSSL 4.1 Arrives With DTLS 1.3, GREASE and More AVX-512 Tuning
OpenSSL 4.1 stable is out, bringing DTLS 1.3 and GREASE support, fresh AVX-512 optimizations, and the final retirement of Windows on Itanium and Windows CE.
-
eMudhra Quits Global SSL/TLS Business After Eight CA Keys Turn Out to Be Guessable
The Indian certificate authority is leaving the global TLS market five days after a researcher recovered the private keys of eight of its intermediate CAs. Chrome and Firefox are dropping trust in the emSign ECC Root CA — G3.
-
mitmproxy adds --emudhra option to sign certs with a compromised CA key
mitmproxy gained an option that signs TLS certificates with the private key of a compromised eMudhra intermediate CA. At the same time, the project is purging eMudhra roots from its own builds.
-
Eight eMudhra intermediate CAs compromised
The private keys of eight eMudhra intermediate certificate authorities have leaked. The certificates chain to roots trusted by major browsers and operating systems.
-
Go to reject certificate chains containing eight distrusted public keys
A patch landing in the go1.27 branch makes crypto/x509 throw away any chain that contains one of eight blacklisted public keys.
-
NGINX Patches Five Bugs, Including Possible RCE and a TLS Flaw That Can Skip Client-Cert Checks
On October 14, NGINX shipped versions 1.30.6 and 1.31.7 fixing five vulnerabilities — one of them present in every release since May 2005.
-
Let's Encrypt to cut certificate lifetimes to 64 days
Starting February 2027, free SSL/TLS certificates from the Let's Encrypt authority will be valid for just 64 days.
-
Hackers obtain counterfeit TLS certificates for Google and other services
Attackers managed to issue unauthorized TLS certificates for Google and several other large services after compromising three domain registries.
-
Cloudflare sets out to become a certificate authority for the whole Internet
Twelve years after launching Universal SSL, Cloudflare has applied to the major root programs and is building a post-quantum certificate authority for the open web.
-
A BGP Hijack Against Softaculous: How a Forged Route Yielded a Valid TLS Certificate
An attack on hosting-panel vendor Softaculous combined a BGP hijack with a legitimately issued TLS certificate, letting the attacker push a malicious Virtualizor update to a small number of installations.
-
Java 27 Is Out: Post-Quantum TLS and G1 by Default
OpenJDK 27 reached General Availability on September 15, 2026. The release is the reference implementation of the Java SE 27 platform and brings nine new features — ranging from finalized mechanisms to previews and incubators.
-
Android 17 Rolls Out ECH: Browser Domains Hidden From Your ISP
Google is baking Encrypted Client Hello into the platform itself, while also tightening local network protection, turning on Certificate Transparency, and making it possible to disable 2G.
-
CubePilot, Maker of Drone Autopilots, Hit by DNS Hijacking
CubePilot, an Australian company that produces flight controllers for drones, has reported a serious breach: attackers seized control of the domain's DNS and intercepted user traffic.