A security researcher examined the fallout from the eMudhra Intermediate CA compromise disclosed on October 20, 2026, which prompted warnings from figures like Russ Cox and Scott Helme that IoT and embedded devices unable to update could be permanently vulnerable to man-in-the-middle attacks. The analysis argues that while single-board computers running full operating systems like Linux are indeed at risk and need updates, true microcontroller (MCU)-class devices generally are not directly affected because of how they handle public key infrastructure and certificate bundles.
danielmangum.com
· 2026-10-21
Researchers found eight intermediate certificates from India's eMudhra with private keys weak enough to be guessed in at most 256 tries, some with as few as 3-8 bits of entropy instead of 384. These certificates chained to roots trusted by major browsers and operating systems, meaning anyone with a key could impersonate any website. Separately, two critical PHP vulnerabilities became public before patches were ready, leaving servers exposed in the interim.
techspot.com
· 2026-10-21
A security researcher discovered that eight eMudhra intermediate certificate authority private keys, including six TLS issuing CAs and two code-signing CAs created in April 2025, were generated as tiny single-digit or small numbers rather than proper random 384-bit values. Browser vendors moved quickly: Chrome blocked the certificates via a CRLSet update and Mozilla followed via OneCRL, with Mozilla later shipping an NSS update to remove the eMudhra root and Chrome confirming removal in its Root Store v43.
scotthelme.co.uk
· 2026-10-21
Google, Mozilla, Apple, and the Go programming language project have blocked trust in certificates issued using eight compromised intermediate certificate authority keys belonging to Indian CA eMudhra. Six of the keys were used for TLS website certificates and two for code signing, raising the possibility that attackers could impersonate legitimate websites or software. Browser makers distributed the blocks automatically, while applications built with Go require developers to rebuild using patched versions 1.27.3 or 1.26.10.
darkreading.com
· 2026-10-20
Certificate authority eMudhra revoked eight intermediate certificates after researcher Wayne found their P-384 private keys were generated with values under 256, making them trivially recoverable. eMudhra said a script error in April 2025 produced the weak keys, which were mistakenly used for signing instead of properly generated ones, and some were cross-signed by Sectigo. Mozilla, Google and Apple have since blocked the compromised certificates in their browsers and operating systems.
bleepingcomputer.com
· 2026-10-20
Security researchers discovered eight intermediate TLS certificates issued by India-based certificate authority eMudhra Limited that used private keys weak enough to be cracked, allowing anyone to forge trusted credentials for any website. An anonymous advisory, signed using one of the compromised keys to prove authenticity, alerted the security community over the weekend. Browser makers and major software platforms moved quickly to block the eight certificates, though no malicious use has been detected in certificate transparency logs so far.
arstechnica.com
· 2026-10-20
A researcher known as Wayne demonstrated that private keys for eight eMudhra intermediate CA certificates had been compromised, by signing a message with each key and submitting proof to root program teams on October 17. These intermediates chain to roots trusted by Mozilla, Microsoft, Apple and Chrome, and eMudhra has since revoked the affected certificates.
emudhra.we-have-a-problem.com
· 2026-10-20
GoKawiil