Eight TLS certificates issued by Indian CA eMudhra have been compromised due to extremely weak private keys, allowing anyone to forge trusted certificates for any website—a threat described as potentially worse than Heartbleed. Browser makers and major apps have blocked the eight intermediate certificates, but cleanup will be lengthy across Linux distros, IoT devices, Docker containers, and various programming language ecosystems.
Background
This incident involves a root/intermediate CA compromise through weak cryptography, requiring widespread certificate updates across trusted systems. The weak keys were likely generated poorly or stored insecurely.
- Source
- Ars Technica
- Published
- Oct 21, 2026 at 03:47 AM
- Score
- 9.0 / 10