eMudhra root CA leak lets anyone run MITM attacks for days or weeks
kingslyj · x · 2026-10-21
Security researcher iangcarroll warns that, following the eMudhra private key incident, effectively anyone can hold a trusted root CA for the next few days or weeks — enough to MITM unwilling devices. Rebroadcaster kingslyj adds a serious note: it may not even be accidental, given how long the weak certs could have been abused. The episode underscores how fragile the web trust chain is when a single CA mishandles its root keys.
Related event: eMudhra CA private keys leaked, threatening trust chain(4 posts)→
More from Safety
- CVSS 10.0 RCE in PHP core: critical patches land Oct 21, PHP 8 only — cyb3rops · 2026-10-21
- Anaconda ships MCP to stop coding agents from hallucinating malicious dependency packages — anacondainc · 2026-10-21
- Skip the open access fees: NIH-funded papers must go on PMC with no embargo — anshulkundaje · 2026-10-21
- Creed: LLM code auditing infers developer beliefs to find semantic security flaws — mboehme_ · 2026-10-21
- Spotify removed 50M+ AI slop tracks from recommendations in a year to back human artists — moustaki · 2026-10-21
- METR signs off on Anthropic's risk report but experts demand quantified uncertainty and neutral evals — DKokotajlo · 2026-10-21