• 

  News ·Vulnerabilities & Zero-Days ·22 Oct 2026, 10:53 UTC

  Emergency block: eight eMudhra CA keys compromised, Chrome, Firefox, Apple and Microsoft cut trust in certificates that could impersonate any website

  The private keys of eight intermediate certificate authority certificates from Indian CA eMudhra were found to be recoverable, letting anyone holding them impersonate websites. Browser makers, operating systems and the Go project rushed out blocks between 17 and 20 October 2026.

  Jay B.

• 

  News ·Vulnerabilities & Zero-Days ·22 Oct 2026, 10:26 UTC

  Node.js patches 10 flaws, including a Brotli bug that permits remote code execution and TLS certificate bypasses

  Node.js released 26.12.1, 24.22.1 and 22.23.4 on 21 October 2026 to fix 10 vulnerabilities, four rated high, including a Brotli decoder flaw that permits remote code execution and two TLS hostname verification bypasses. The update also blocks the compromised eMudhra certificates.

  Jay B.