Comment by agwa
2 days ago
Other certificate verifiers are doing the same:
Node: https://github.com/nodejs/node/pull/66871
rustls/webpki: https://github.com/rustls/webpki/pull/546
Electron: https://github.com/electron/electron/pull/55126
This is very serious and you should definitely upgrade. Hopefully OpenSSL will have a patch soon as well.
from nodejs's diff:
> These are the eMudhra/emSign intermediates whose private keys were reported compromised in October 2026.