#pki

Starting tomorrow, Chrome shows NET::ERR_CERT_AUTHORITY_INVALID for InCommon SSL certificates on eMudhra's ECC root. 3,134 at 41 schools still chain to it.

Skip eMudhra RSA, it's leaving too. Move once:

https://www.certkit.io/blog/incommon-err-cert-authority-invalid

#PKI #SSL

One of the private keys trusted by browsers was the number 4. eMudhra, an Indian certificate authority, generated eight intermediate CA keys in April 2025 that were almost entirely zeros, recoverable in under a second.

A researcher reported them on 17 October. Mozilla recovered the keys itself that evening and browsers blocked them within hours. The board has now voted eMudhra out of the global TLS business. Nobody hacked anything; the weakness was born in the key ceremony, seventeen months earlier.

https://www.theregister.com/security/2026/10/20/indian-certification-authority-emudhras-private-keys-compromised-one-of-them-was-the-number-4/5304312

#CyberSecurity #InfoSec #PKI

Practical angle for platform teams: on 24 Oct, Oracle's JDK update removed eMudhra's G1, G2 and G3 roots from the default Java truststore. A precaution, not proof that all three roots were compromised, but it's how a CA incident becomes an application incident. Do you know which of your services trust which roots?

#Java #PKI

A weak key is an event. A weak feedback loop is a condition.

Eight eMudhra CA keys could be recovered by trying fewer than 256 values each. (A good P-384 key has ~10^115 possibilities.) The algorithm was fine; generating or selecting the key wasn't.

Across seven public Bugzilla reports (different severities, no proven common cause), one question recurs: was the rule enforced, verified, and tested after the fix?

Timeline and sources: https://banbreach.com/insights/emudhra-certificate-incidents/?utm_source=mastodon&utm_medium=organic_social&utm_campaign=controls_on_trial_01&utm_content=thread_pattern #InfoSec #PKI #Java

Two infrastructure failures, one week.

PHP2Shell (CVE-2026-109618/109619, CVSS 9.2): unauthenticated RCE in PHP. PoCs out the same day as patches. Fix: 8.5.12 / 8.4.27 / 8.3.36 / 8.2.35 — then check for prior exploitation.

eMudhra: CA keys so weak one was literally the number 4. Recoverable in seconds. Chrome removes the root Oct 27 — ~30,800 certs at risk.

Two problems, two responses.

🔗 https://threataft.com/articles/php2shell-emudhra-infrastructure-failures-different-responses

#CyberSecurity #PHP #PKI #CVE #InfoSec

🔓🚨 SIGINT // Cybersecurity Watch — 2026-10-24
Leaked private keys from 8 CA certs let attackers impersonate any domain—billions of older devices/software remain exposed until patched.
https://www.tomshardware.com/tech-industry/cyber-security/leaked-private-keys-for-eight-ca-certificates-let-any-attacker-impersonate-any-domain-billions-of-older-devices-and-software-installations-may-be-vulnerable-after-round-of-fixes-patch-yours-immediately
#InfoSec #PKI #Cybersecurity #CVE

We have to stop pretending that the #WebPKI governance is making sense.

Here's GoDaddy revoking 400k certs because they cannot follow simple compliance rules:

https://www.heise.de/en/news/GoDaddy-revokes-hundreds-of-thousands-of-certificates-over-documentation-errors-11497136.html

And this is not their first time. Has there been any consequences for them so far? Nope.

Use #DANE, pin your certs, or do anything other than relying on a "trust store" from [Mozilla|Microsoft|Google|Apple|etc].

#x509 #pki #eMudhra

Oracle Java security alert CVE-2026-91403 (CVSS 9.1) distrusts compromised eMudhra intermediate certificates in Java SE and GraalVM. Update now.

#Oracle #Java #eMudhra #CVE202691403 #GraalVM #TLS #PKI #CyberSecurity

https://securityonline.info/oracle-java-security-alert-emudhra-cve-2026-91403/?utm_source=mastodon&utm_medium=jetpack_social

🤖 eMudhra (Indian CA) exits its global SSL/TLS business after a researcher recovered the private keys of 8 intermediate CA certs — reportedly guessable. Board decision came 5 days after disclosure; affected customers get free replacements from partner CAs.
🔗 https://thehackernews.com/2026/10/emudhra-to-exit-global-ssltls-business.html
#CyberSec #PKI #TLS

-----BEGIN EC PRIVATE KEY-----
4
-----END EC PRIVATE KEY-----

That's they key behind Internet2's InCommon SSL.

The root gets distrusted on Tuesday, and about 30K certificates need to get replaced.

https://www.certkit.io/blog/emudhra-internet2-incommon-distrust

#PKI #SSL

We had 35 built-in SSL certificate deployment templates in July. It's 86 now!

New: A10 Thunder, Cisco ISE, VMware Horizon, OpenVPN, WatchGuard, and IBM i.

https://www.certkit.io/blog/certificate-deployment-integrations-roundup

#SSL #PKI

In response to the eMudhra / emSign certificate security incident we've published guidance for Python users to update CA certificates: https://discuss.python.org/t/information-for-python-users-regarding-emudhra-emsign-ca-certificate-security-incident/109576

#security #Python #pki

🤖 eMudhra revoked 8 intermediate CA certs whose private keys were so weak anyone could recover them almost instantly. Mozilla, Google and Apple now block them after forged trusted certificates became trivial to produce.
🔗 https://www.bleepingcomputer.com/news/security/mozilla-google-apple-block-compromised-emudhra-ca-certificates/
#CyberSec #PKI #TLS

Major browsers revoked eMudhra intermediate certificates after researchers discovered trivial P-384 private keys vulnerable to brute-force compromise.

#eMudhra #Cybersecurity #PKI #Encryption #InfoSec

https://meterpreter.org/emudhra-intermediate-certificates-compromise/?utm_source=mastodon&utm_medium=jetpack_social

🤖 Eight eMudhra intermediate CA private keys are compromised, confirmed by Mozilla and Chrome Root Program. Whoever holds one can mint browser-trusted certs for any domain. Google, Mozilla, Apple and the Go project are blocking them; how the keys leaked is still unknown.
🔗 https://thehackernews.com/2026/10/eight-emudhra-ca-keys-compromised.html
#PKI #TLS #InfoSec #CyberSec

In a parallel world browsers and service providers alike are using DANE and you wouldn't have even known if a random CA was compromised or not.

#ca #pki #x509 #dnssec #dane

RE: https://thecybersecguru.com/news/emudhra-ca-compromise-copy-slug/

🚨 eMudhra CA compromise: 8 intermediate certificate keys confirmed compromised.

The incident triggered emergency distrust measures across browsers and software, including Firefox’s OneCRL protections and urgent Go security updates.

The bigger concern is the long tail: outdated binaries, containers and applications with their own certificate stores may not inherit browser protections.

How do you revoke trust across the entire internet?

Technical breakdown 👇
https://thecybersecguru.com/news/emudhra-ca-compromise/

#InfoSec #CyberSecurity #TLS #PKI

New Go security releases added explicit distrust for some specific intermediate CA certificates belonging to eMudhra Technologies Limited. Interestingly, this is tracked as CVE-2026-111943 but no details on why this was done are provided.

https://github.com/golang/go/commit/7f86f957633ee31a1c17a1eb8452ca7a3d9bc141

#pki #CVE_2026_111943 #infosec #cybersecurity