eMudhra's 8 intermediate CAs use keys under 256; browsers race to block
dotey · x · 2026-10-22
- Eight eMudhra intermediate CA certificates use private keys smaller than 256 (examples: 4, 56, 115) — crackable in under a second. Generated in April 2025, they went undiscovered until Oct 17, 2026; multiple parties have independently recovered the keys, some publicly.
- Cloudflare warns holders can forge certificates for any site, impersonating banks on public Wi-Fi with the padlock still showing.
- Browsers contained it quickly: Chrome and Firefox blocked the CAs same day, Apple on Oct 19, Microsoft on Oct 20; CT logs show the CAs never issued public certs, so browser users were largely protected.
- The hard part is outside browsers: apps, corporate servers, routers and IoT devices ship their own trust stores, don't check CT logs, and may never receive updates; Cloudflare itself must patch hundreds of services.
More from Safety
- Claude Security goes continuous: scans code as it changes, has found 1M+ vulnerabilities — rohanpaul_ai · 2026-10-22
- Critical PHP vulnerability scores 9.2; AI expected to weaponize patch in 15 minutes — MariyaSha888 · 2026-10-22
- Veracode report: AI now writes half of committed code but only 56% pass security checks — WeldPond · 2026-10-22
- Researcher Warns AI Cyberattacks on Grid Possible Within a Year, Shares Prep List — cephaloform · 2026-10-22
- New preprint shows LLMs form hidden beliefs about users that affect refusals — zeynepakata · 2026-10-22
- OpenAI expands AI cybersecurity push, hiring a DX engineer for its Cyber team — romainhuet · 2026-10-22