Our Response To The eMudhra Key Disclosure Incident

The Go team shipped its first URGENT-track security release, Go 1.27.3 and 1.26.10, after researchers found that eight eMudhra intermediate certificates had keys weak enough to recover quickly, which could allow forged TLS certificates. Rebuilt binaries reject those intermediates, and Go says the patch went out about seven and a half hours after notification. The details come mainly from Go's own account. Go lacks revocation support on Linux, so it plans parity work, including evaluating upki. Teams should rebuild and check toolchain versions.