CA weak-key flaw hid for 18 months; researcher cracked it reportedly with AI-assisted tooling
teortaxesTex · x · 2026-10-22
A CA incident post-mortem: a key ceremony flaw (not missing HSMs) produced a second, weak set of keys that was published to browser root stores. The issue went undetected through two audit cycles for 18 months until a researcher reverse-engineered the weak keys, reportedly with AI-assisted tooling. eMudhra suggested the researcher used AI, while Mozilla's thread shows they used Google's OSS tool Project Paranoid. Impact is limited to TLS certificates chaining to a distrusted ECC root in one US customer ecosystem; no evidence of exploitation. Expect more AI finger-pointing, the author notes.
More from Safety
- Dario's predictions on track: Mythos 'security tsunami' warning and 6-12 month China catch-up window — rickasaurus · 2026-10-23
- Boundless offers abliterated DeepSeek V4.1 Flash for defensive security testing — MoonL88537 · 2026-10-23
- php2shell zero-day sparks AI cybersecurity debate as Anthropic uses Claude to harden 25 OSS codebases — connoraxiotes · 2026-10-23
- PHP hit by two unauthenticated RCE flaws; ProjectDiscovery launches free internet-wide alert service — cyb3rops · 2026-10-23
- Arista VeloCloud Orchestrator SQL injection flaw, CVSS 9.9, actively exploited — AIFlow_ML · 2026-10-23
- Bindu Reddy mocks AI security panic: world didn't end, but Anthropic says it'll get 'a lot worse' — bindureddy · 2026-10-23