Post

i was up very late last night please make sure you’re patched

all atproto server-side apps/services: you are affected. - pds: service proxying is outbound tls requests - firehose consumers: tls to relays/jetstream - relays etc: tls to pdses, plc - identity resolution: tls to plc and did:web hosts - etc if you only ship code to the browser, you are ok.

20/10/26, 4:33 pm3 reposts59 likes

fig (aka:[phil])

@bad-example.com

🫡 github.com/bluesky-soci...

github.combuild: Go 1.26.10 for CVE-2026-111943 by amckinley · Pull Request #1517 · bluesky-social/indigoBumps the Go toolchain to 1.26.10 for CVE-2026-111943 (golang/go#82345). Go 1.27.3 and 1.26.10 make crypto/x509 distrust eight eMudhra intermediates (EM {DV,OV,EV} TLS CA - G3B/G3C, EM OV CS CA - G...