Researchers found eight intermediate certificates from India's eMudhra with private keys weak enough to be guessed in at most 256 tries, some with as few as 3-8 bits of entropy instead of 384. These certificates chained to roots trusted by major browsers and operating systems, meaning anyone with a key could impersonate any website. Separately, two critical PHP vulnerabilities became public before patches were ready, leaving servers exposed in the interim.
techspot.com
· 2026-10-21
A security researcher discovered that eight eMudhra intermediate certificate authority private keys, including six TLS issuing CAs and two code-signing CAs created in April 2025, were generated as tiny single-digit or small numbers rather than proper random 384-bit values. Browser vendors moved quickly: Chrome blocked the certificates via a CRLSet update and Mozilla followed via OneCRL, with Mozilla later shipping an NSS update to remove the eMudhra root and Chrome confirming removal in its Root Store v43.
scotthelme.co.uk
· 2026-10-21
Security researchers discovered eight intermediate TLS certificates issued by India-based certificate authority eMudhra Limited that used private keys weak enough to be cracked, allowing anyone to forge trusted credentials for any website. An anonymous advisory, signed using one of the compromised keys to prove authenticity, alerted the security community over the weekend. Browser makers and major software platforms moved quickly to block the eight certificates, though no malicious use has been detected in certificate transparency logs so far.
arstechnica.com
· 2026-10-20
A researcher known as Wayne demonstrated that private keys for eight eMudhra intermediate CA certificates had been compromised, by signing a message with each key and submitting proof to root program teams on October 17. These intermediates chain to roots trusted by Mozilla, Microsoft, Apple and Chrome, and eMudhra has since revoked the affected certificates.
emudhra.we-have-a-problem.com
· 2026-10-20
GoKawiil