Practical angle for platform teams: on 24 Oct, Oracle's JDK update removed eMudhra's G1, G2 and G3 roots from the default Java truststore. A precaution, not proof that all three roots were compromised, but it's how a CA incident becomes an application incident. Do you know which of your services trust which roots?
XFEDI
ActivityPubConversation
TELL 1: Fixes that don’t hold.
2025: six CRLs with invalid signatures. Closed as fixed: automated signing, mandatory verification.
14 Oct 2026: another invalid CRL signature reported on another CA. Cause not established.
So: what failure was the fix actually tested against?