Go's emergency update makes programs refuse connections tied to eight certificate keys, so rebuilt software could suddenly fail to reach some sites and services.
Go, a popular programming language, shipped an urgent update on October 20. Programs built with Go 1.27.3 or Go 1.26.10 will refuse to connect to any site or service whose certificate was issued under one of eight specific keys. If your business software is built with Go, rebuilding it on the new version could cut off some partner connections without warning.
A certificate is a digital ID that proves a website is the real one. Certificate authorities issue them, sometimes through middle layers called intermediates. Go's checker now rejects any chain that passes through eight of those intermediate keys. A blocked connection fails with the error "x509: no valid chains built."
The change has no off switch. It also appears to apply when a program uses its own list of trusted roots, so a private setup that deliberately trusts one of these keys will fail too. The Go team has not said whether that is intended.
The Go team says the keys belong to one certificate authority it has not named. It cites "specific security concerns around their operation." It used its URGENT track, which is reserved for its most serious issues, and recommends upgrading immediately. Its policy says there are no recent examples of that track, and it has not said why this one qualified.
Go's change lists only coded fingerprints of the keys. A commenter on the Go issue matched all eight to intermediates from eMudhra, an Indian certificate authority. Six are for websites and two are for signing code. The Hacker News has not independently checked that matching. Two days earlier, Mozilla blocked six eMudhra intermediates in Firefox's block list. Whether Chrome, Apple or Microsoft have acted is not established.
The main group is anyone running software built with Go. Existing programs keep their old behavior until they are rebuilt, so nothing breaks the moment the update is released. Some projects, including Bluesky's indigo, were already rebuilt on October 20. Go 1.25 and older are out of support and get no fixes, so a supported release is the only route.
Sites and services using certificates under the eight keys will need a certificate from a different intermediate before rebuilt Go programs can reach them. If your software is not built with Go, this change does not touch it.
The alert box above lists the steps. The short version is to find out whether you use Go software, test key connections first, then apply the update. No temporary workaround exists.
eMudhra's older roots are trusted in the Chrome, Apple and Mozilla root stores. In September, a public review of its request to add ten new roots closed with no objections. Watch for a statement from eMudhra, Go or Mozilla.
Before rebuilding Go software on the new release, test connections to partners and services, because some may stop working.
A user says Anthropic's Claude Code put his email in web requests, then scam messages arrived. The link is unproven, but it shows what AI tools can share.
Read more: User says Claude Code sent his email address to websitesA viral ChatGPT prompt turns what the chatbot remembers about you into a room image. Posting it publicly could give scammers clues to target you.
Read more: Viral ChatGPT room image could hand scammers clues about youA message saying your Amazon account was hacked is often the scam itself. Checking in the Amazon app first can protect your card, gift balance and phone.
Read more: If Amazon says your account was hacked, check before you call
