The private keys of eight eMudhra intermediate CA certificates have been compromised. They chain to roots trusted by the QtWebEngine trust store (via NSS).
See eMudhra Intermediate CA Compromise for more details and a test page.
tl;dr: Someone messed up and used "4" as a private key (among other single-byte keys), you might want to run this script as a mitigation until packages are upgraded.
Thanks to Kerin Millar for the script. I have verified this fixes the issue on Archlinux, and expect it to work on other Linux distributions as well. On Windows/macOS, in theory this could work as well if you find out where your NSS store used by qutebrowser is, and how to get a copy of certutil.
I plan to push a release of qutebrowser for macOS/Windows once this is fixed proper in QtWebEngine and released, but so far I haven't heard back from them.
Unfortunately, QtWebEngine also does not support certificate revocation via CRLsets, so qutebrowser (and others using QtWebEngine) still happily accepts those certificates without manual mitigation or an upstream
update. (Despite being closed, this remains without a proper fix for a decade)
There's an open issue in the Gentoo bugtracker to distrust the certificate, and I just reported this to Archlinux as well.
Note: While the CVE cited in the subject is technically in Go, it still seems widely used to refer to this issue at whole, so I included it for visibility.
Also, independently, consider temporarily shutting down your PHP installations and patching them as soon as a patch is available.
What a week.