Field Note 06 · Deimos AI LLC · 2026-10-21
Every program keeps its own keys.
On 20 October 2026 it became public that 8 eMudhra intermediate certificate authorities had private keys that anyone could work out. Each private key was a number under 256, and a secret with fewer than 256 possible values is found by trying them all. Whoever holds one of the keys that sign website certificates can issue a certificate for any site, and any program that still trusts it will take the forgery for the real thing.
The browsers moved fast. Firefox and Chrome blocked the certificates on 17 October, three days before the news was public. Apple devices followed on 19 October and Microsoft platforms on 20 October. If you updated your browser this week, you did the right thing. You also fixed one program.
Trust is not one switch
It is natural to picture trust as a setting on the machine: one list of certificate authorities that everything consults. That is not how a computer works. It holds many such lists, and most programs read only their own.
The curl command usually reads a bundle file. Node.js carries its own copy of the roots, compiled into the binary. Python programs often use certifi, a bundle installed beside the code. A Go or Rust program carries its checking code inside the binary, and it changes only when someone rebuilds it with a patched version. An Electron app ships its own Chromium and Node.js, and updates when the app does. A container image keeps the list it was built with. A device that no longer gets updates keeps the list it had on the day they stopped.
Each list is patched by its own maintainers, on its own schedule, and reaches you only when you take the update that carries it. Patching the browser is not patching the machine.
What we found on our own machine
We didn’t want to argue this from theory. On 21 October we asked the programs on one of our own Macs whether they still trusted the compromised keys.
macOS itself blocks the intermediates. Its built-in curl and python3 did not: they read /etc/ssl/cert.pem, a file Apple had not updated, and they kept trusting the keys until we removed the affected roots from that file by hand.
Node.js gave two answers. The official build of Node.js 26.12.0, the current release when we checked, carries its own roots, emSign ECC Root CA - G3 among them, and it trusted the keys. A fix was merged into Node.js on 20 October (nodejs/node#66871 ↗) and is waiting for a release. The Node.js from Homebrew, built to use the system’s certificate store, refused. Two copies of the same runtime, on the same machine, disagreed.
Even Chrome had a gap. It blocks the keys through CRLSet, a block list it fetches in the background. A fresh Chrome profile connected to 6 of the 12 test sites until its CRLSet arrived. A browser opened for the first time, or opened rarely, can be behind its own fix.
None of this is exotic. These are the ordinary programs on a working computer.
How to check honestly
The obvious check is to search a file for the bad root. It answers the wrong question. A program may not read the file you searched, may carry a copy you can’t see, or may block the intermediates while the root is still present. What matters is what the program does when it connects.
So an honest check asks each runtime to connect, the way its own programs do, to sites signed with the compromised keys, and watches whether it refuses. It also needs a control. If the test sites can’t be reached, a refusal proves nothing: the network failed, not the trust. And if a check could not have come out “exposed”, its “safe” means nothing either. A check that couldn’t fail must never say “safe”.
That is how Wardlatch works. On its page, in any browser, phones included, one button has the browser open a page with a normal certificate first, as the control, and then the 12 public test sites from the advisory. On a computer, npx wardlatch (version 0.1.2) puts the same question to every node, curl and python3 on your path, and to the Python environments in your projects. Each runtime gets a control first: run with the compromised roots forced in, or, where that isn’t possible (macOS’s own networking layer), asked to open a normal site, so a check that couldn’t have failed reports “could not be tested”, never “safe”.
Wardlatch runs on your own device. It sends nothing about you anywhere and changes nothing; it prints the fix beside anything that connects. The command checks 6 incidents in all, this one included.
What to do this week
Check. Open www.deimoscore.com/wardlatch/ in every browser you use, on your phone too, and run npx wardlatch on every computer that builds or runs code.
Rebuild. Take the patched versions the advisory lists for curl’s bundle, certifi, Go, Rust’s webpki crates and Electron, then rebuild your container images and compiled programs: a binary keeps what it was built with until someone builds it again. On a Mac, fix /etc/ssl/cert.pem by hand until Apple updates it; the Wardlatch page has the command. For the official Node.js, take the release that carries the fix as soon as it ships.
Replace. If a site or service you run has a certificate issued by eMudhra, replace it with one from another authority. eMudhra estimates that about 30,000 website certificates need replacing, and Mozilla has decided to remove its trust in emSign ECC Root CA - G3 altogether.
Re-check. Run the check again after every fix. A fix nobody measured is a hope, not a fix. Devices you can’t update stay on the list: treat them as exposed, keep them on networks you control and plan their replacement.
The flight rule underneath
Our second Flight Rule is Assume something is already inside: design every system as if the attacker already has a key, then make the key not enough. This week the key was not a thought experiment. Anyone who wanted one could compute it. The browsers made it not enough within days. Every other program on your machine keeps its own keys, and each one has to be checked on its own.
Start with the check at /wardlatch/. The release covers the rest of this week’s incidents. Wardlatch is free and open source, and when it can’t tell, it says so.