GoAhead 6.1.1 fixes TLS flaws: revoked certs accepted, DH downgrade
FoxIO's Sébastien Féry found three TLS backend bugs in EmbedThis GoAhead. CVE-2026-115881 (CVSS 9.1) ignores client-cert revocation. Fix is 6.1.1.
Stories tagged: #tls
Browsers block 8 compromised eMudhra intermediate CA keys
A researcher proved possession of the private keys for eight eMudhra intermediate CAs. Chrome, Firefox, Apple and Microsoft have blocked them; Go shipped a fix.
Go blocks eight CA keys in emergency 1.27.3/1.26.10 update
Go 1.27.3 and 1.26.10 hard-block eight intermediate CA keys over undisclosed 'security concerns.' Chains through them now fail with x509: no valid chains built. Rebuild.
NGINX fixes five flaws, including a TLS client-cert bypass
NGINX 1.30.6 and 1.31.7 fix five CVEs: three heap bugs that can crash workers, an HTTP/3 request-smuggling bug, and a TLS session-ticket forgery that can skip client-cert checks.
Let's Encrypt moves to 64-day certificates by default in 2027
Let's Encrypt cuts its default certificate lifetime from 90 to 64 days on February 10, 2027, with 45-day certs following in 2028. If renewals aren't ARI-aware, fix that now.
Node.js ships June 18 security release — 12 CVEs across v22, v24, v26
Node.js v22.23.0, v24.17.0 and v26.3.1 fix 12 CVEs including a TLS wildcard hostname bypass (CVE-2026-48618) and a WebCrypto integer overflow DoS (CVE-2026-48933).