Certificate authority (eMudhra) generated eight of its intermediate signing keys so badly that anyone can recover the private keys from the public certificates. That means anyone can mint a "valid" HTTPS certificate for any site, such as your bank, GitHub, or PyPI, and impersonate it.
Much better explanation here
https://cycle.io/blog/2026-intermediate-ca-compromise
This is the Go version of the initial HN post https://news.ycombinator.com/item?id=50166579
As in - could I connect to a site signed with those certificates and see that my browser/client accepted that certificate?
I assume these certificates have been pulled from most browsers - but - an un-updated curl or wget would still accept these, right?
EDIT: found https://emudhra.we-have-a-problem.com/ , scroll down to 'Does your client still trust the compromised intermediates?'
EDIT 2: a few tests you can also run...
curl https://dv-g3b-emudhra.we-have-a-problem.com/
import urllib.request;print(urllib.request.urlopen("https://dv-g3b-emudhra.we-have-a-problem.com/").read().decode())The really fun stuff are stuff like:
1. embedded and IOT stuff that doesn't ever get OS updates or even have an OS. People are using this to MITM stuff like smart TVs and household appliances and then pwn them.
2. In some cases a Linux container is run in a context where the OS is hidden from it (think serverless/container as a service type platforms). It might not have access to the OS trust store and have to fall back on the one built into the stdlib.
I noticed that Firefox didn't show any connections on that page (good) but when I ran the curl command, it did connect (bad) and I had to update my Ubuntu packages manually to resolve.
Mine hadn't been updated yet. I'm not sure why Firefox was failing the page check but, in some ways, it was a false positive for me.