CVE-2026-111943: Compromised Intermediate Certificate Authority

Commenters said the issue is a compromised intermediate CA from eMudhra whose intermediates were generated so poorly that private keys could be recovered, enabling anyone to mint certificates and perform MITM attacks. Practical advice from users included updating distribution ca-certificates (Gentoo, Slackware examples), testing with provided curl endpoints, and applying language/runtime-specific fixes: Python users and bundled cert stores (certifi, bun) need updates, and Go has proactively blocked the bad intermediates because it uses its own trust store. Several commenters emphasized that some software bundles the compromised certs into binaries, so OS-level distrust isn’t always sufficient.

Opinion split around responsibility and remediation. Many blamed eMudhra for the key-generation debacle and urged swift updates; others criticized Red Hat’s pace (some said RHEL lagged behind Debian), while some defended or explained vendor workarounds that disable affected roots. A few users questioned whether Go’s proactive blocking was necessary if OS trust stores had been updated, and others lamented the operational fallout for home labs, container users, and less technical admins. There were also practical workarounds shared (macOS curl CA bundle override, scripts to manage Debian CA lists) and some commenters dismissed the post as repetitive or old news.