eMudhra intermediate CA keys turn out to be tiny numbers like 4 and 56
TrentonBricken · x · 2026-10-21
Per Ars Technica, intermediate CA private keys from eMudhra turned out to be tiny numbers like 4 and 56 — recoverable in seconds, letting anyone mint a fully trusted certificate for any site and MITM users harvesting credentials. Eight compromised TLS certs put the internet on high alert.
Key points:
- Browsers have blocked the bad certs, but the long tail of servers, containers and devices still trusting them has not
- One bad key-generation script from 2025 is forcing a Heartbleed-scale internet-wide cleanup
- The author cites this as why AI people are legitimately stressed about internet resilience against agentic cyber attacks — with more to come
More from Safety
- User documents several real dangerous Gemini incidents in one thread — Regular_Manager_6235 · 2026-10-21
- Sentry CEO on SOC2 in the AI era: verify who's merging your code — zeeg · 2026-10-21
- 'PHPcolypse': More UAF Bugs Found in PHP Core, Dev Suggests Rewriting with Codex — basedjensen · 2026-10-21
- php2shell POC Leaked Early: Mitigation Alone May Not Be Enough, Patch PHP Now — basedjensen · 2026-10-21
- Unitree G1 cleared by FCC before rules change, reselling in US is legal — carlosdponx · 2026-10-21
- Paper claims ChatGPT silently builds psychological profiles of users, 96% of memories stored unasked — provenauthority · 2026-10-21