eMudhra intermediate CA keys exposed: P-384 secrets nearly all zeros, MITM risk
davidcrawshaw · x · 2026-10-21
Russ Cox shared that Mozilla Bugzilla now publicly details the eMudhra intermediate CA private key compromise: the P-384 keys were all zeros except the last 8 bits. All not-yet-updated software can be MITM'ed now, and IoT boxes that can't or don't update are trivially MITM-able forever — a Hanlon's razor moment, incompetence rather than malice.
More from Safety
- Two unpatched 9.0/10 RCE flaws hit Linux's in-kernel SMB server KSMBD — emax · 2026-10-23
- FDA crosses a regulatory watershed with personalized neoantigen cancer vaccine, per Gottlieb — alex_peys · 2026-10-23
- Abliterated GLM-5.3 or DS V4.1 Flash plus compute lets motivated individuals do anything, argues viral thread — khademinori · 2026-10-23
- AI uncovers PHP2Shell flaw threatening the tech behind 70% of all websites — AIFlow_ML · 2026-10-23
- Ben Murphy on this week's cyber events: deployment models and open-source risks — herbiebradley · 2026-10-23
- Only 8% of cloud vendors support OIDC — dev calls to kill long-lived API keys — cramforce · 2026-10-23