Web PKI breaks again: eMudhra CA keys cracked in milliseconds
An eMudhra intermediate CA was compromised, and a follow-up post titled "Eight Bits of Trust" showed its keys could be cracked in milliseconds. Anyone holding a compromised intermediate's private key could impersonate any website. Commenters called it criminal negligence, and one noted that 4 isn't even prime.
The cleanup is the real story. Maintainers shipped fixes across ecosystems: Go 1.27.3 and 1.26.10, rustls-webpki 0.103.16, webpki-roots 1.0.10, and certifi 2026.10.19. The top complaint is structural: why should anyone have to ship a new Go or Electron release, possibly over a now-suspect TLS connection, just to revoke a certificate? "Web PKI is cursed" is the consensus.
The pattern: revocation is effectively broken, so trust-store changes travel through language releases and package updates. That makes every pinned dependency and slow-to-update container a latent liability.
So what?
If you ship software that bundles its own root store (Go, Rust, Python, Electron, containers), you now need a fast path to push trust-store updates. Check your dependency pins today. Also consider whether you depend on any CA you have never audited.