Post by @Aatube@lemmy.dbzer0.com

@Aatube@lemmy.dbzer0.com

2026-10-20 22:20 UTC

The Internet goes on high alert after discovery of 8 compromised TLS certs Astonishingly, the private keys were 4, 56, 66, 115, 155, 156, 230, 237. exploiting compromised certificates requires an active adversary-in-the-middle attack, meaning the attacker must act as a proxy between two TLS parties and receive encrypted traffic, decrypt it, reencrypt it, and send it to the other party. Such capabilities, in some cases, are usually limited to only the most well-resourced attackers. People with control of a local network—at a coffee shop, university, or other organization—face much less of a challenge. emudhra.we-have-a-problem.com

Replies (12)

@BluescreenOfDeath@lemmy.world 2026-10-20 22:32

Okay, that’s fun and scary at the same time. The article links to a webpage, emudhra.we-have-a-problem.com That shows if your browser is still using those certs, and though it says Firefox has already updated, maybe it hasn’t reached mobile yet as it shows I’m using them all still. I guess I won’t connect to anything important for a few days.

Open ##5281133
@thisbenzingring@lemmy.today 2026-10-21 03:12

I think that this isn’t really getting the right attention, about what a massive WTF situation this is… its a 384 bit certificate and this is the private key 00:00:00:00:00:00:00:00:00:00:00:00:00:00:00: 00:00:00:00:00:00:00:00:00:00:00:00:00:00:00: 00:00:00:00:00:00:00:00:00:00:00:00:00:00:00: 00:00:04 that is just fucking NUTS

Open ##5281352
@RedGreenBlue@lemmy.zip 2026-10-21 03:55

Fennec and firefox forks about:config --> security.enterprise_roots.enabled --> enable

Open ##5281764
@masterofn001@lemmy.ca 2026-10-21 00:53

On grapheneOS, i just manually disabled the root CA’s in the trusted root store. These are all android versions on graphene: *There are now 14 certs AFFECTED: Firefox (nightly) ,Ironfox, and fennec STILL connects to all 12 Tor connects to 6 of them Cromite is still affected by 6 of them. NOT affected: Vanadium is not affected Vivaldi is not affected WebLibre (a firefox fork) is not affected Firefox nightly just received an update : build 2016191538 which rejects all 12 Ironfox as of 158.0.1 (Build #2016191578) is no longer affected. Tor is fixed as of 15.0.26 (140.17.0esr) (Build #2016191530) Fennec all clear

Open ##5282156
@Azazel@lemmy.ml 2026-10-21 04:34

Why would this put vpn users at risk if browsers have already blocked the problematic certs?

Open ##5283760
@Die4Ever@retrolemmy.com 2026-10-21 05:30

As noted, most browsers have already blocked the intermediate certificates. The exception appears to be Edge running on Windows 10, which at the time this article went live was still connecting to 12 vulnerable hosts. LOL

Open ##5287972
@pHr34kY@lemmy.world 2026-10-21 06:26

Open ##5291902
@thoralf@discuss.familie-will.at 2026-10-21 04:22

IronFox all green here

Open ##5292150
@clickthebuton@lemmy.world 2026-10-21 06:57

SSL has had a broken trust model for decades. We need something truly decentralized and auditable.

Open ##5293588
@superglue@lemmy.dbzer0.com 2026-10-20 22:52

So if my understanding is correct, to be exploited the attacker would already need to be in a position to intercept your traffic, but this means when they do they can effectively impersonate anyone. This could actually be an interesting attack vector for hacking IOT devices. If you control the DNS server the device connects to you can get it to trust literally anything.

Open ##5294769
@stopforgettingit@lemmy.world 2026-10-21 17:23

This plus the php thing and everything I was planning on doing today is out the window 😖

Open ##5305854
@magnue@lemmy.world 2026-10-21 09:24

Adversary-in-the-middle = man-in-the-middle?

Open ##5317302