Compromised eMudhra intermediate CAs could mint valid fake certificates for any domain
i_dg23 · x · 2026-10-22
A Japanese dev warns about a certificate trust-chain incident: attackers may have been able to forge cryptographically valid TLS certificates for domains they don't own (e.g., Google or bank domains). A checker page shows multiple eMudhra/emSign intermediate CAs still trusted, flagged with red "Connected" results.
Combined with DNS hijacking or route takeover, this would enable eavesdropping/tampering of HTTPS, theft of logins, cookies and API tokens, fake content distribution, and tampered software downloads.
No confirmed exploitation yet, but users are urged to run the check and fully update OS and browsers if vulnerable — Edge users especially. The author even suggests asking an AI agent for help with the update.
More from Safety
- Defense must run at machine speed: agents patch, engineers judge — saranormous · 2026-10-22
- CVEs jumped from ~4k to ~15k a month since April, and the security treadmill is breaking — saranormous · 2026-10-22
- US government reportedly pressed Anthropic to slow mythos cyber rollout — bookwormengr · 2026-10-22
- OpenAI restricts Daybreak access for security researchers, critics call it a mistake — andersonbcdefg · 2026-10-22
- Security engineers rush to secure Drupal and PHP apps amid exploit wave — unixterminal · 2026-10-22
- Internet Archive fends off PHP attacks overnight, using Claude to patch old code — kingslyj · 2026-10-22