Post

If you make HTTPS requests or have other TLS clients and care about MITM attacks, you need to update today. If you run Go: go get go@1.27.3 If you run Homebrew: brew update brew install ca-certificates If you run Linux, maybe stay off the internet for now.

Filippo Valsorda@filippo.abyssdomain.expert

🚨 Six WebPKI Intermediate CAs are compromised. This is bigger than Heartbleed, but a client-side issue. Anything that verifies certificates against public roots, like most TLS clients, is/was affected. Details, live test, patched versions and workarounds at emudhra.we-have-a-problem.com Act now.

emudhra.we-have-a-problem.comeMudhra Intermediate CA CompromiseeMudhra Intermediate CA Compromise

20/10/26, 3:14 pm47 reposts127 likes

Girl Lich 🏳️‍⚧️⚢💀

@girllich.link

if you run linux just link your agent to this post

Russ Cox

@swtch.com

If you use gcloud, there is no update yet that corrects the two certificate root sets it hard-codes. The best workaround on Mac seems to be: brew install ca-certificates gcloud config set core/custom_ca_certs_file /opt/homebrew/etc/openssl@3/cert.pem

Russ Cox

@swtch.com

For gcloud on Linux, you need to get a fixed root set some other way (see the Linux section of emudhra.we-have-a-problem.com for patching the system ones, although a patched copy would be fine) and then run the same 'gcloud config set' command with your patched file.

Russ Cox

@swtch.com

I'm pretty surprised Apple has not fixed /usr/bin/curl yet— don't run 'curl | bash' in a coffee shop today! Rather than modify the system certs and trust they won't be modified back, I installed the Homebrew curl and put it first on my $PATH.