Field note — 17 Oct 2026
Browsers were patched in hours. Your CI runner was patched when someone rebuilt the image.
Eight intermediate CA private keys were recovered in under 30 milliseconds. The browsers were fixed the same day; the clients your pipeline actually runs were not.
A researcher recovered the private keys for eight eMudhra intermediate CA certificates. Every key was an integer below 256 — one of them was the number 4. Recovering all eight took under 30 milliseconds. Anyone holding them could forge a trusted certificate for any site.
Chrome blocked the affected intermediates through a CRLSet push the same day; Firefox followed via OneCRL, Apple on the 19th, Microsoft on the 20th. Certificate Transparency meant a forged certificate could not have been used quietly against a browser in the first place.
Published testing a day later found macOS’s own /usr/bin/curl 8.7.1 and Node.js 25.3.0 connecting to compromised test chains without raising anything at all. uv 0.13.3 verified them as valid. Go rejected them. Python rejected them only once a new certifi bundle shipped. Non-browser clients overwhelmingly do not check revocation or transparency, and cannot be fixed by a push.
What it meansLockfile integrity hashes protect a dependency you already pinned. They do nothing for a first install, for npx, or for a curl | bash line in a provisioning script. Most organisations patched their browsers, told themselves they were done, and still cannot name every trust store they operate.