CA eMudhra suffers intermediate certificate private key compromise, criticized for slow response
basedjensen · x · 2026-10-24
- A P1 compliance defect on Mozilla Bugzilla discloses that certificate authority eMudhra suffered a private key compromise of intermediate certificates. The key compromise occurred on April 30, 2025, carried out by people with years of PKI industry experience who had worked with the company.
- eMudhra's public response claims intense social media scrutiny from investors and customers has made meaningful analysis difficult, while pledging to uphold its disclosure obligations to the community.
- Security researcher ScottHelme slammed the explanation — 'sorry we've been too busy on Twitter and trying to keep our investors happy' — calling it unbelievable for a trusted root program participant. The bug is flagged as a crypto security issue with a potential security bounty.
Related event: CA eMudhra Suffers Intermediate Key Leak, Audit Reveals More Issues(3 posts)→
More from Safety
- Claude Code audit finds 214,856 "permanently deleted" photos lurking in Android hidden cache — Loo_Atreides · 2026-10-26
- Microsoft patches Authenticator flaw (CVE-2026-80097, CVSS 8.6) letting zero-permission apps steal tokens — basedjensen · 2026-10-26
- CNN: AI is exposing how fragile the web really is — and what users can do about it — cnn · 2026-10-26
- IIT Madras hosts AI Governance conclave with 400+ attendees on responsible AI — ravi_iitm · 2026-10-26
- “CIA watching everyone patch ‘security vulnerabilities’” goes viral — tekbog · 2026-10-26
- Weight-tampering worm scenario for near-frontier models called 'somewhat scary' — teortaxesTex · 2026-10-26