[qutebrowser-announce] PSA: Compromised eMudhra intermediates (CVE-2026-111943)

[Freya Bruhin]

Hey!

The private keys of eight eMudhra intermediate CA certificates have been
compromised. They chain to roots trusted by the QtWebEngine trust store
(via NSS).

See https://emudhra.we-have-a-problem.com/ for more details and a test
page.

tl;dr: Someone messed up and used "4" as a private key (among other
single-byte keys), you might want to run a script as a mitigation until
packages are upgraded:
https://984601.bugs.gentoo.org/attachment.cgi?id=972696

Thanks to Kerin Millar for the script. I have verified this fixes the
issue on Archlinux, and expect it to work on other Linux distributions
as well. On Windows/macOS, in theory this could work as well if you find
out where your NSS store used by qutebrowser is, and how to get a copy
of `certutil`.

I plan to push a release of qutebrowser for macOS/Windows once this is
fixed proper in QtWebEngine and released, but so far I haven't heard
back from them.

Unfortunately, QtWebEngine also does not support certificate revocation
via CRLsets, so qutebrowser (and others using QtWebEngine) still happily
accepts those certificates without manual mitigation or an upstream
update: https://qt-project.atlassian.net//browse/QTBUG-58059
(Despite being closed, this remains without a proper fix for a decade)

There's an open issue in the Gentoo bugtracker to distrust the
certificate, and I just reported this to Archlinux as well:
https://bugs.gentoo.org/show_bug.cgi?id=984633
https://gitlab.archlinux.org/archlinux/packaging/packages/qt6-webengine/-/work_items/16

Note: While the CVE cited in the subject is technically in Go, it still
seems widely used to refer to this issue at whole, so I included it for
visibility.

Also, independently, consider temporarily shutting down your PHP
installations and patching them as soon as a patch is available:
https://www.vincentschmalbach.com/cve-2026-109618-and-cve-2026-109619-what-you-should-do-now/
https://phpc.social/@Girgias/117476510850918355

What a week.
- Freya