Go statically links its standard library, so the new block on eight revoked eMudhra intermediates (CVE-2026-111943) only takes effect in programs compiled with Go 1.27.3 or 1.26.10. Upgrading the Go toolchain on a server does nothing for binaries already running there.

1. Find Go binaries and their toolchain: go version -m /path/to/binary prints the Go version a binary was built with (the first line) plus its module list. Run it across container images, /usr/local/bin, CI artifacts and agents (Terraform providers, kubectl plugins, exporters, sidecars, CLIs like gh and many security tools are Go).
2. Rebuild what you own on 1.27.3/1.26.10 and redeploy. In Dockerfiles, pin the patch version (golang:1.27.3), not just 1.27, so a cached base image isn't reused.
3. Third-party Go tools: watch for vendor releases built on the new toolchain. Until then, those tools still trust the revoked chains.
4. Test for breakage: before rollout, connect rebuilt clients to your partner and API endpoints. An x509: no valid chains built error means that endpoint chains through one of the blocked intermediates and needs a new certificate.
5. Make it routine: Go ships minor security releases roughly monthly. Set a recurring rebuild-and-redeploy for Go services so fixes like this aren't left sitting in old binaries.