Astonishingly, the private keys were 4, 56, 66, 115, 155, 156, 230, 237.
exploiting compromised certificates requires an active adversary-in-the-middle attack, meaning the attacker must act as a proxy between two TLS parties and receive encrypted traffic, decrypt it, reencrypt it, and send it to the other party. Such capabilities, in some cases, are usually limited to only the most well-resourced attackers. People with control of a local network—at a coffee shop, university, or other organization—face much less of a challenge.
https://emudhra.we-have-a-problem.com/
LOL
Edge on windows 11 also did it. At least as of last night. My debian boxes are up to date and they have been fixed.
Newest release of Firefox Nightly on Android also still seems to connect.
I updated my Firefox today in the afternoon and afterwards it didn't connect.
I did try with Fennec from F-Droid, which was fine. I updated Nightly just now, and it does still connect.
Edit: Firefox Beta connects to 6/12 on https://emudhra.we-have-a-problem.com/
Edit 2: Regular Firefox connects to 0/12
Edit 3: Latest update fixed this in nightly, I haven't checked beta.
Thankfully someone did pull their finger out and get it done an hour later, thankfully Windows also moved to a live CRL requiring no reboots and it's only hundreds of thousand of unpatched Linux boxes that remain affected 😓
Uhhhh as a dumb dumb Ubuntu user, do I need to do anything other than update?
Updating is all 😊 just need to make sure you have the latest CA-certificates package
my Ubuntu 24.04 server is secured despite not updating anything or rebooting (I have now, but curl was already declining it before)
other issues would be software not respecting the system level certs, but that can happen on any OS, it just depends on the program