No one's spared: a Java vulnerability is here
Oracle issued an out-of-band security alert on October 21 for CVE-2026-91403, rated critical (CVSS 9.1), after private keys for eight intermediate CA certificates from Indian certificate authority eMudhra were found compromised by a flawed key-generation ceremony — one private key was literally the number 4. Anyone holding the keys could mint trusted HTTPS certificates for any domain and impersonate websites. It matters because the bug sits in JSSE, Java's TLS implementation, and affects every supported Java version, so enterprises and developers should apply Oracle's emergency update immediately.
SOURCES
- LinuxDo2026-10-22 07:44