On October 22, 2026, Indian certificate authority eMudhra announced it will withdraw from the global SSL/TLS certificate business, five days after a researcher recovered the private keys of eight intermediate CA certificates — every one of them below 256. If your organization issues certificates under the emSign ECC Root CA - G3 root, you have until October 27 to move to another hierarchy.

On 6 October 2026, Google revealed that attackers had seized the .gh, .sl and .as registries, rewrote DNS records, and obtained unauthorized HTTPS certificates for Google and several other major brands. Domain owners should monitor Certificate Transparency logs and publish restrictive CAA records, because browser-side blocking does not protect non-browser clients.