https://vanemmerik.ai/supply-chain/ Supply Chain Watch entries: Go. en https://vanemmerik.ai/supply-chain/2026-10-24/#emudhra-trust-store-updates vea-sc-2026-10-24-emudhra-trust-store-updates Sat, 24 Oct 2026 21:53:00 +0000 The eight eMudhra intermediate CA keys disclosed on Oct 20 were generated so weakly that anyone can recover them, which means a network attacker could mint certificates those intermediates sign; exposure dates back to April 2025, though no misuse has been found. Browsers block them already, but package managers, CI jobs and API clients that carry their own CA bundle keep trusting the chain until updated. Fixed bundles: certifi 2026.10.19, pip 26.2.2, uv 0.13.4, Node.js 22.23.4/24.22.1/26.12.1, Go 1.27.3/1.26.10, rustls-webpki 0.103.16, webpki-roots 1.0.10, composer/ca-bundle 1.4.16/1.6.0, plus Ubuntu, Debian, Alpine, Fedora and Wolfi ca-certificates. Bun, FreeBSD and Java's JDK cacerts were still unfixed or unconfirmed on Oct 23, and container images keep the old roots until rebuilt. What to do: Bump certifi, pip, uv, Node.js, Go and Rust webpki crates to the fixed versions, rebuild container images on patched base images, and check Java and Bun services separately; the system bundle should contain no emSign entries after updating. https://vanemmerik.ai/supply-chain/2026-10-24/#x402-sdk-spending-limit-flaws vea-sc-2026-10-24-x402-sdk-spending-limit-flaws Sat, 24 Oct 2026 10:08:00 +0000 V12 reported three flaws in the x402 agent-payment SDKs, published Oct 22-23. The TypeScript fetch and axios clients had no default spending cap, so a hostile API could ask an agent to sign away its full balance; @x402/svm 2.0.0 to 2.22.0 accepted a Solana token approval as payment; and the sign-in extension could sign a login for another site. TypeScript packages are fixed in 2.23.0 (current is 2.28.0); the Python and Go clients were fixed in their Aug 18 releases, with exact versions not stated. There is no CVE or GHSA, npm audit does not flag the old releases, and no attacks have been reported. What to do: If your agents pay with x402, move the @x402 packages to 2.23.0 or later (and the Python/Go clients to current releases) and set an explicit per-request spending limit.