tls

Canonical's LXD 6.10.1, 5.21.9, 5.0.11 and 4.0.15 and MicroCloud 3.4.1 and 2.1.5 fix a TLS certificate-chain flaw; CISA's entry in the CVE record, dated October 30, lists exploitation as none. Incus fixed it in 7.6.0.

A comparison of how uv, pip, CPython, the AWS CLI and the Azure CLI handled the compromised eMudhra intermediate CAs, drawing on release notes, pull requests, Mozilla and Cloudflare.

Three Erlang/OTP patch packages dated October 14, 2026 list four shared CVEs; 29.1.2 adds a fifth, a denial-of-service in erl_tar that also affects Hex and rebar3 copies.

Go 1.26.10 filters certificate chains through a set of eMudhra intermediates; Cilium, Terraform and OpenTofu have since released builds, and the Go thread debates the hardcoded approach.

Node.js published its October 21 security releases for the 26.x, 24.x and 22.x lines: ten CVEs, four rated High, plus c-ares, Undici and certificate updates.

Let's Encrypt says it will issue 64-day certificates by default from February 10, 2027, shortening authorization reuse to 10 days; 45-day certificates follow in 2028.

Rustls's September 7 release turns on NIST-standardized ML-DSA post-quantum certificates by default for the aws-lc-rs provider, plus a KeyLogFile permissions fix and an ECH certificate-verification fix.

OpenSSL 4.0.0 landed on April 14 as the library's first major version bump since 2018, adding ECH, post-quantum hybrid key exchange, and removing the legacy engine API and SSLv3.

On April 15, 2026, Mozilla and Google removed DigiCert's legacy G1 root certificates from their trust stores, forcing holdouts on legacy chains to reissue TLS certificates or face untrusted errors.