Overview
- A researcher credited as “Wayne” reported the compromise on Saturday, October 17 and proved control by signing a message with each private key; Chrome and Firefox pushed blocklists that day and eMudhra revoked the eight intermediates with Apple and Microsoft taking action on October 19 and 20.
- Go issued emergency releases on October 20 that make the Go verifier reject any certificate chain containing the eight compromised public keys and require projects to rebuild with the new Go binaries to pick up the fix.
- Browser vendors and root‑store operators pushed rapid mitigations such as CRLSets, OneCRL and root removals, and packages including NSS, certifi, rust webpki‑roots and Homebrew published updates that remove or block the affected roots.
- The compromised intermediates matter because they can issue certificates accepted by browsers; Chrome blocked by public key so cross‑signed copies by Sectigo are also caught, and Chrome said no TLS certificates chaining to the six website intermediates were logged to Certificate Transparency before the block.
- The root cause and full exposure window remain under active investigation and eMudhra has not published a detailed timeline; users should update browsers, OS packages and developer toolchains while operators rebuild or replace certificates for services that chained to the affected intermediates.