Ethical Hacking News
Go has issued an emergency update to block eight intermediate certificate authority keys due to undisclosed security concerns. The update, which was released on October 20, 2026, affects versions 1.27.3 and 1.26.10 of the Go programming language. The Go team has not provided any details about the security concerns surrounding these keys, but the update will reject any certificate chain that passes through one of these eight intermediate keys. This update is part of the Go team's "URGENT" track, which is reserved for the most critical issues that pose a threat to the integrity of the Go ecosystem.
The Go programming language has issued an emergency update to block eight intermediate certificate authority keys due to undisclosed security concerns. The update, released on October 20, 2026, applies to versions 1.27.3 and 1.26.10 of the Go language. The update will reject any certificate chain that passes through one of the eight intermediate keys, issued by a certificate authority not publicly named. The filter is applied in the Go verifier and in macOS and Windows code paths, making it difficult to disable or workaround. The Go team has not provided details on the security concerns, which is unusual for their security releases. The issue affects the entire ecosystem, including projects rebuilt on the new releases. Sites and services whose certificates chain through the eight keys may need certificates from a different intermediate to connect.
The online cybersecurity news platform, The Hacker News, has recently issued an alert about an emergency update from the Go programming language, designed to block eight intermediate certificate authority keys due to undisclosed security concerns. This update was released on October 20, 2026, and applies to versions 1.27.3 and 1.26.10 of the Go programming language.
According to the The Hacker News article, the Go team has taken this action as part of its "URGENT" track, which is reserved for the most critical issues that pose a threat to the integrity of the Go ecosystem. The update will reject any certificate chain that passes through one of these eight intermediate keys, which are issued by a certificate authority that has not been publicly named.
The article explains that the filter is applied in Go's own verifier and in the macOS and Windows code paths that hand verification to the operating system. This means that any program built on the new release will refuse connections to sites and services whose certificates were issued under these eight keys. The change contains no setting to turn the filter off, so even if a private deployment intentionally trusts one of the eight keys, it will still fail.
The Go team has not provided any details about the security concerns surrounding these keys, stating only that they are related to "specific security concerns around their operation." The article notes that this is unusual for the Go team, as it typically provides more information about the reasons behind its security releases.
The issue is particularly concerning because it affects the entire ecosystem, as many projects, including Bluesky's indigo, were rebuilt on the new releases on October 20. The article mentions that two days earlier, on October 17, Mozilla added six intermediate certificates issued by eMudhra's emSign Root TLS CA - G3 to OneCRL, the list Firefox uses to block certificates. However, the Mozilla bug behind those entries is closed to the public, and neither Mozilla nor Go has said what prompted its action.
The article provides some background information on eMudhra, an Indian certificate authority that sells certificates under the emSign brand. Its roots emSign Root CA - G1 and emSign ECC Root CA - G3 are in the Chrome, Apple, and Mozilla root stores. The company told Mozilla earlier this year that its newer TLS root is cross-signed by emSign Root CA - G1, which is how certificates under the newer root chain to a trusted root.
The article concludes by stating that Go 1.25 and older releases are out of support and get no fixes, so the only route is a supported release from the download page. No temporary workaround exists in any source, and the filter cannot be disabled. Sites and services whose certificates chain through the eight keys will need certificates from a different intermediate before rebuilt Go clients can connect to them.
Related Information:
https://www.ethicalhackingnews.com/articles/Go-Issues-Emergency-Update-Blocking-Eight-CA-Keys-Over-Undisclosed-Security-Concerns-ehn.shtml
https://thehackernews.com/2026/10/go-issues-emergency-update-blocking.html
https://imtr.net/article/go-issues-emergency-update-blocking-eight-ca-keys-over-undisclosed-security-e105
Published: Tue Oct 20 16:29:34 2026 by llama3.2 3B Q4_K_M
