Live › campaign › CMP-202610-taiwan-certificate-authority-twca-reports-unauthorized-acces

medium⚡ Early warning · no CVE yetInfrastructure

Taiwan certificate authority TWCA reports unauthorized access to its certificate RA server

TWCA (Taiwan-CA), a publicly trusted certificate authority, self-reported to Mozilla on 2026-10-29 that its monitoring detected signs of unauthorized access to its Registration Authority (RA) server, the system that approves certificate requests. TWCA isolated the server and is still investigating. It says no certificate mis-issuance has been found so far and promises a full incident report. Who is behind it, how they got in, when it started and whether any certificates were requested: unknown. At risk: anyone who trusts TWCA roots (browsers, OS and language trust stores) and TWCA customers, if attackers got certificates issued for domains they do not own.

Summary written from the sources below. Check the originals before acting.

Known so far

4/6

medium

no CVSS yet; severity from the sources

known so far4 of 6

missing: primary source, exploitation

First public: Oct 29, 2026 UTC
Last modified: Oct 29, 2026
Status: open
Known exploitation: None reported
Public exploit: None on GitHub
EPSS: not scored

First seen by InfraStack 2026-10-29 13:06 UTC. All times on this page are UTC.

Who is affected

1 product

Product	Ecosystem	Affected	Fixed in
TWCA certificates	–	unknown	–

Who cares: campaign, certificate-authority, early-warning
Not affected if: –

How to check

Search Certificate Transparency logs (crt.sh, Censys) for TWCA-issued certificates for your domains that you did not request
If you have CAA records, check whether they allow TWCA (twca.com.tw)
If you are a TWCA customer, review recent certificate orders and issuances in your account
Specific IOCs or affected certificate serials: unknown

The fix

Add CAA records that allow only the CAs you use
Set up CT monitoring for your domains
TWCA customers: watch for TWCA notices and be ready to revoke and reissue certificates if the incident report shows mis-issuance
Watch Mozilla Bugzilla 2086949 for the full report and any trust-store action

Know the next one before it finds you.

Add to Slack

Taiwan certificate authority TWCA reports unauthorized access to its certificate RA server

Summary written from the sources below. Check the originals before acting.

Product

Ecosystem

Affected

Fixed in

TWCA certificates

–

unknown

–

Taiwan certificate authority TWCA reports unauthorized access to its certificate RA server

Who is affected

How to check

The fix

Know the next one before it finds you.

Taiwan certificate authority TWCA reports unauthorized access to its certificate RA server

Who is affected

How to check

The fix

Know the next one before it finds you.

Who had it, and when

Sources