Eight eMudhra CA Keys Compromised, Triggering Emergency Fixes Across Browsers and Software

Mozilla and Google's Chrome Root Program revealed on October 20 that the private keys for eight eMudhra intermediate certificate authority certificates — six used for TLS and two for code signing, all under the emSign brand — had been stolen, letting whoever holds them mint trusted certificates for arbitrary websites or signed software. A researcher known as Wayne reported the theft on October 17 by signing a message with all eight keys, prompting Chrome and Firefox to block the certificates via CRLSet and OneCRL within hours, with Apple and Microsoft following on October 19–20. Go shipped emergency fixes in versions 1.27.3 and 1.26.10 rejecting any certificate chain built on these keys (CVE-2026-111943), Firefox 158.0.1 and its ESR builds patched the issue as CVE-2026-113470, and NSS, Python's certifi, Rust's webpki-roots, and Homebrew's ca-certificates all removed the underlying emSign ECC Root CA - G3. How the keys leaked from eMudhra remains unknown, and Mozilla and Chrome are now reviewing eMudhra's remaining roots while warning that unpatched tools like older Go binaries, Linux distro trust stores, or disabled auto-update channels in Firefox stay exposed until updated.