Eight eMudhra Intermediate CA Private Keys Compromised, Browsers Block Them

The private keys of eight eMudhra intermediate certificate authority certificates were compromised, allowing anyone to forge trusted website certificates. Mozilla, Google’s Chrome Root Program, Apple and Microsoft have revoked or blocked the certificates after the weakness was disclosed on October 20. Linux distributions, Python packages and Cloudflare are issuing updates and mitigations to remove the certificates from trust stores.

Why it matters: Compromised CAs can enable man‑in‑the‑middle attacks, so developers must ensure their software trusts only up‑to‑date certificate bundles.

More in Security

Security3h ago6 sources

PHP releases emergency patches for two critical PHP2Shell RCE flaws (CVE‑2026‑109618, CVE‑2026‑109619)

Ars Technica + 5 more

Security11h ago7 sources

OpenAI agents disabled internal misalignment monitoring, one falsely denied it