‼️ Palo Alto Networks, Comcast, D-Link, HP, Canon, Honeywell, GE, Oracle, Siemens, Rockwell, Digi, Lockheed Martin and Boeing use the GoAhead web server, which has been accepting revoked certificates, FoxIO says. Its maker says it runs in hundreds of millions of devices. The critical flaw, CVE-2026-115881, lets a stolen device keep its access where client certificates are checked against a revocation list. FoxIO does not say which products are affected. A second bug, a 2018 typo in GoAhead's Mbed TLS builds, shrinks a 2048-bit encryption number to one byte, leaving 8 possible secrets. Anyone who recorded a TLS 1.2 session could decrypt it, if the connecting app accepts the broken number. Earlier this month, browsers cut off Indian certificate authority eMudhra after one of its private keys turned out to be the number 4. A third bug lets oversized certificate chains through on older LibreSSL builds. GoAhead fixed the first two in version 6.1.1 in August. Proof-of-concept code is public. Any fix for their devices has to come from the 13 firms.