GO has issued an emergency update for Go 1.27.3 and Go 1.26.10, released on 20 October 2026, that blocks eight intermediate certificate authority keys from a single unnamed CA whose operation the Go team says raises “specific security concerns”. The new builds cause Go’s certificate verifier to reject any certificate chain that passes through those eight keys.
The change is applied across Go’s own verifier and the macOS and Windows code paths that defer to the OS for verification, and there is no switch to disable the filter. In practice, programs will refuse connections to sites and services whose certificates were issued under those keys, and a rejected chain surfaces as x509: no valid chains built.
The update also affects private deployments: since the filter is not toggleable and the verifier does not perform revocation checks or consult public block lists, private trust roots that include any of the eight keys will fail until rebuilt with different intermediates.
Evidence and scope reported by The Hacker News ties the eight keys to eMudhra intermediates tied to the emSign Root TLS CA - G3 (six TLS intermediates) and emSign Root CS CA - G3 (two code-signing intermediates). Specifically, the TLS intermediates are EM DV TLS CA - G3B and EM DV TLS CA - G3C (both for TLS), EM OV TLS CA - G3B and EM OV TLS CA - G3C (organization-validated TLS), EM EV TLS CA - G3B and EM EV TLS CA - G3C (EV TLS), while the code-signing peers are EM OV CS CA - G3B and EM OV CS CA - G3C.
Mozilla’s OneCRL had recently added certificates from emSign Root TLS CA - G3, though Mozilla and Go have not publicly stated the exact triggering factor. The article notes that Bluesky’s Indigo and other projects rebuilt on the new releases, and that Go 1.25 and earlier are out of support. No workaround exists, and the filter cannot be disabled.