{"id":"CMP-202610-taiwan-certificate-authority-twca-reports-unauthorized-acces","kind":"campaign","aliases":[],"related":[],"title":"Taiwan certificate authority TWCA reports unauthorized access to its certificate RA server","description":null,"summary":"TWCA (Taiwan-CA), a publicly trusted certificate authority, self-reported to Mozilla on 2026-10-29 that its monitoring detected signs of unauthorized access to its Registration Authority (RA) server, the system that approves certificate requests. TWCA isolated the server and is still investigating. It says no certificate mis-issuance has been found so far and promises a full incident report. Who is behind it, how they got in, when it started and whether any certificates were requested: unknown. At risk: anyone who trusts TWCA roots (browsers, OS and language trust stores) and TWCA customers, if attackers got certificates issued for domains they do not own.","severity":"medium","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"TWCA certificates","fixed":[],"vendor":"TWCA (Taiwan-CA)","affected":"unknown"}],"ecosystems":[],"tags":["campaign","certificate-authority","early-warning"],"not_affected_if":[],"how_to_check":"Search Certificate Transparency logs (crt.sh, Censys) for TWCA-issued certificates for your domains that you did not request. If you have CAA records, check whether they allow TWCA (twca.com.tw). If you are a TWCA customer, review recent certificate orders and issuances in your account. Specific IOCs or affected certificate serials: unknown.","fix":"Add CAA records that allow only the CAs you use. Set up CT monitoring for your domains. TWCA customers: watch for TWCA notices and be ready to revoke and reissue certificates if the incident report shows mis-issuance. Watch Mozilla Bugzilla 2086949 for the full report and any trust-store action.","status":"open","published_at":null,"first_seen_at":"2026-10-29T13:06:38+00:00","triaged_at":"2026-10-29T13:06:38+00:00","updated_at":"2026-10-29T13:06:38+00:00","category":"infrastructure","confidence":null,"triage":null,"analyst_status":"done","analyst_note":null,"search":"'-10':48B '-202610':14A '-29':49B '2026':47B 'acces':22A 'access':7A,57B 'anyon':116B 'approv':67B 'attack':131B 'author':3A,28B,40B,61B 'authority':18A 'behind':98B 'browser':121B 'ca':35B 'campaign':25B 'certif':2A,10A,27B,39B,68B,81B,110B,133B 'certificate':17A 'certificate-author':26B 'certificates':24A 'cmp':13A 'custom':129B 'detect':53B 'domain':136B 'earli':30B 'early-warn':29B 'far':89B 'found':87B 'full':93B 'got':102B,132B 'incid':94B 'investig':77B 'isol':71B 'issu':134B 'issuanc':84B 'languag':124B 'mis':83B 'mis-issu':82B 'monitor':52B 'mozilla':45B 'os':122B 'promis':91B 'public':37B 'ra':11A,62B 'registr':60B 'report':5A,43B,95B 'reports':20A 'request':69B,112B 'risk':115B 'root':120B 'say':79B 'self':42B 'self-report':41B 'server':12A,63B,73B 'sign':54B 'start':106B 'still':76B 'store':126B 'system':65B 'taiwan':1A,16A,34B 'taiwan-ca':33B 'taiwan-certificate-authority-twca-reports-unauthorized-acces':15A 'trust':38B,118B,125B 'twca':4A,19A,23A,32B,70B,119B,128B 'unauthor':6A,56B 'unauthorized':21A 'unknown':113B 'warn':31B 'whether':108B","nicknames":[],"mitigations":[],"who_affected":null,"tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":null,"audience":null,"plain_action":null,"first_public_at":"2026-10-29T00:00:00+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"analyst","external_id":"CMP-202610-taiwan-certificate-authority-twca-reports-unauthorized-acces","url":null,"severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-29T13:06:38+00:00","fetched_at":"2026-10-29T13:06:38+00:00","note":null}],"documents":[{"id":16446,"url":"https://news.ycombinator.com/item?id=50287867","title":"TWCA reports unauthorized access to its certificate RA server","kind":"post","source":"hackernews","publisher":null,"text":"TWCA reports unauthorized access to its certificate RA server\nhttps://bugzilla.mozilla.org/show_bug.cgi?id=2086949\n\n2 points, 0 comments on Hacker News","published_at":"2026-10-29T12:28:12+00:00","relation":"describes","confidence":null,"note":null},{"id":16594,"url":"https://bugzilla.mozilla.org/show_bug.cgi?id=2086949","title":"TWCA: Unauthorized access to an RA server (Mozilla Bugzilla 2086949)","kind":"advisory","source":"analyst","publisher":null,"text":"TWCA self-reported incident. TWCA's security monitoring systems detected indicators of unauthorized access to our Registration Authority (RA) server. The affected server was isolated, and our investigation is ongoing. No certificate mis-issuance has been identified to date. A full incident report will be provided. Relevant policies: Mozilla Root Store Policy, Section 2.4.1. Status: UNCONFIRMED.","published_at":"2026-10-29T00:00:00+00:00","relation":"describes","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}