You're viewing the front-end.social public feed.

Federated feed Local feed

Filippo Valsordafilippo@abyssdomain.expert
Oct 20, 2026, 2:23 PM
🚨 Six WebPKI Intermediate CAs are compromised.
This is bigger than Heartbleed, but a client-side issue.
Anything that verifies certificates against public roots, like most TLS clients, is/was affected.
Details, live test, patched versions and workarounds at https://emudhra.we-have-a-problem.com
Act now.
💬 4🔄 177⭐ 94

Replies

Leah Neukirchenleah@blahaj.social
Oct 20, 2026, 2:28 PM
@filippo the AAA Certificate Services domains still connect after updating to NSS 3.131.1, is that update only a partial fix?
💬 2🔄 1⭐ 1
Cassandrichdalias@hachyderm.io
Oct 20, 2026, 2:41 PM
@leah @filippo Wow, AAA Certificate Services was supposed to be distrusted a year ago. Alpine has it removed from ca-certificates but Firefox on Alpine still had it.
💬 1🔄 2⭐ 5
light nail lransitlnl@screaminginsi.de
Oct 20, 2026, 2:42 PM
@dalias @leah @filippo not shipped yet
💬 0🔄 0⭐ 0
Leah Neukirchenleah@blahaj.social
Oct 20, 2026, 8:39 PM
@filippo following up to myself: the NSS certificates only permit it for e-mail.
💬 0🔄 0⭐ 0
kasperdkasperd@westergaard.social
Oct 20, 2026, 2:31 PM
Their page to test if a client is affected is severely broken. For me it reported that my browser was safe without even conducting the test.
💬 1🔄 0⭐ 0
Cats Who Code (cursed)CatsWhoCode@twoot.site
Oct 20, 2026, 5:41 PM
@kasperd for which browser? :blobPikaScream: @filippo
💬 0🔄 0⭐ 0
kasperdkasperd@westergaard.social
Oct 20, 2026, 6:24 PM
Same problem regardless of whether I visit the site in Chromium or Firefox.
💬 0🔄 0⭐ 0
Dr. Christopher Kunzchristopherkunz@chaos.social
Oct 20, 2026, 2:31 PM
@filippo Six? I thought eight?
💬 0🔄 0⭐ 2
Buttered Jortsajn142@infosec.exchange
Oct 20, 2026, 5:15 PM
@filippo either the page is broken, or their reporting that a Microsoft fix has shipped is inaccurate.
💬 1🔄 0⭐ 0
Buttered Jortsajn142@infosec.exchange
Oct 20, 2026, 5:21 PM
@filippo curl.exe is fixed, but Invoke-WebRequest (what curl is aliased to in PowerShell) and the latest Edge Browser with CRLSet 6498.2026.10.1 are still vulnerable (back half of CRLSet looks like a date, if so then this is from the first of October, and attempting to update CRLSet returns "up-to-date")
Edit: Screenshots
💬 0🔄 1⭐ 1
Buttered Jortsajn142@infosec.exchange
Oct 20, 2026, 6:27 PM
@filippo likewise, the two files used to automatically update the Windows-level cert store haven't been updated since August 2026 and September 2025(!!!).
💬 1🔄 0⭐ 0
Hopeless Noosphere Situation Goblin :catte: :asexual_flag:cyberquixote@infosec.exchange
Oct 20, 2026, 6:28 PM
@ajn142 @filippo and this is why I DONT FUCKING USE WINDOWS
💬 1🔄 0⭐ 1
Buttered Jortsajn142@infosec.exchange
Oct 20, 2026, 6:29 PM
@cyberquixote I don't get a choice lol, I've got to make sure the winders is patched
💬 1🔄 0⭐ 1
Hopeless Noosphere Situation Goblin :catte: :asexual_flag:cyberquixote@infosec.exchange
Oct 20, 2026, 6:34 PM
@ajn142 "do you have a windows device in your house that you care about or depend on"
the fuck I do
💬 0🔄 0⭐ 1