8 intermediate CA certs issued with single-byte P-384 keys, exploitable by anyone
cyb3rops · x · 2026-10-21
Security researchers report that private keys from 8 intermediate CA certificates issued by eMudhra have been compromised — and the P-384 keys were apparently generated from single-byte seeds, meaning anyone can locally derive them and issue valid certificates with no effort.
The flaw seems to have gone undetected since issuance in 2025, prompting calls to update everything immediately. A severe incident affecting the entire trust chain.
More from Safety
- Privacy evals: Muse Glimmer-30B leaks less than Qwen3.6-27B on CIMemories — TimDarcet · 2026-10-21
- Policy experts urge BIS and DDTC to assess frontier models' ability to aid export-controlled tech — jachiam0 · 2026-10-21
- Fake-stats site deindexed by Google was still cited by ChatGPT for 7 months — petrusenko_max · 2026-10-21
- Princeton launches AI Alignment and Safety research initiative — HazanPrinceton · 2026-10-21
- ByteDance, Alibaba, Tencent order 3M+ Nvidia RTX PRO 5500 cards worth $35B, Reuters reports — SumitGup · 2026-10-21
- CVSS 10.0 RCE vulnerability disclosed in PHP core, patches only for PHP 8 — cyb3rops · 2026-10-21