Story perspectives

Mozilla and major browsers quickly untrust eMudhra certificates

By Drooid · Oct 21, 2026, 11:59 AM UTC · How we work

Summary

eMudhra Compromises CAs

eMudhra compromised eight intermediate CA certificates by using weak private keys.
The keys, intended as 384-bit random numbers, were single-byte values (4, 56, 66, 115, 155, 156, 230, 237).
Researchers recovered all eight keys in under a second and reported the flaw on October 17, 2026.
Mozilla blocked the certificates in Firefox within three hours and Chrome, Apple, and Microsoft removed trust by October 20.
eMudhra revoked the eight certificates, halted issuance from the root, and began migrating roughly 30,000 customers.

Summary

Filippo Valsorda Warns

Cryptography expert Filippo Valsorda warned remediation could exceed the 2014 Heartbleed cleanup effort.
He said forgotten Linux machines, smart-home IoT devices, and background tools may stay vulnerable for years.
Researchers demonstrated the flaw by posting a signed message on emudhra.we-have-a-problem.com.
The attack would need a man-in-the-middle position, such as control of a local Wi-Fi network.

1 of 2

eMudhra Compromises CAs

eMudhra compromised eight intermediate CA certificates by using weak private keys.
The keys, intended as 384-bit random numbers, were single-byte values (4, 56, 66, 115, 155, 156, 230, 237).
Researchers recovered all eight keys in under a second and reported the flaw on October 17, 2026.
Mozilla blocked the certificates in Firefox within three hours and Chrome, Apple, and Microsoft removed trust by October 20.
eMudhra revoked the eight certificates, halted issuance from the root, and began migrating roughly 30,000 customers.

1 / 2