eMudhra CA Key Compromise Triggers Cross-Platform Certificate Blocks

A PKI compromise at eMudhra exposed private keys for eight intermediate certificate authorities, enabling anyone to forge valid TLS certificates for arbitrary domains. Major platform vendors and runtime maintainers responded with coordinated certificate blocklists, but the fragmented trust store landscape means command-line tools and embedded libraries may still accept the compromised certificates.

• Go shipped its first-ever URGENT track security release within seven and a half hours of notification on October 19, patching the runtime to block the compromised certificates.
• Apple has blocked the certificates automatically in Safari, Mail, and apps using its frameworks since October 19, but command-line tools like curl and git that check /etc/ssl/cert.pem may still accept them until a future update.
• Gram 3.4.0 was released to address the vulnerability from shipping rustls-webpki and webpki-roots packages, with users advised to upgrade or rebuild from source with updated webpki packages.
• Node.js released updates on October 21 addressing both eMudhra and a separate Brotli vulnerability, but Socket notes that other applications and runtimes bundling the same decoder or certificate stores require separate updates.

Bottom line Audit your certificate trust stores across runtimes, CLI tools, and embedded libraries to ensure the eMudhra blocks have propagated everywhere TLS verification happens.