Google warns cloud users over compromised certificate authority keys

Google Cloud has warned customers that eight eMudhra subordinate certificate authority certificates are being revoked after a researcher reported that their associated private keys were compromised. Google says it received the report on October 17 and published its cloud security bulletin on October 23, updating affected-service guidance on October 28. According to the bulletin, the keys were generated with insufficient cryptographic randomness. Google says that weakness could allow an attacker with network access to reconstruct the keys, forge trusted TLS certificates and intercept connections from clients that still trust the affected authorities. The company says Google Cloud infrastructure itself remains uncompromised, but lists services, base images and client software that may be affected. Google advises customers to review product-specific guidance for their deployments. Teams should check trust stores and affected software rather than assume a cloud service update automatically covers every application or client. The bulletin identifies the issue as CVE-2026-111943.