Go Releases Emergency Updates to Block Eight Compromised Certificate Authority Keys

The Go security team has released emergency updates Go 1.27.3 and Go 1.26.10, dated October 20, 2026, which modify the Go certificate verifier to reject any certificate chain that passes through one of eight specific intermediate certificate authority keys. The Go team has not publicly identified the certificate authority associated with the eight keys, citing undisclosed security concerns. Programs built on these releases will refuse connections to sites and services whose certificates were issued under the blocked keys, potentially disrupting access to affected services. The update is described as a preventive measure to block potentially compromised or misissued certificates before they can be exploited. No known active exploitation has been reported. The specific certificate authority and the nature of the security concerns are pending official Google advisory disclosure. Users and organizations are advised to update to Go 1.27.3 or Go 1.26.10 to ensure certificate verification functions as intended.