CA eMudhra used the number 4 as a private key; Cloudflare tracks active exploitation
jedisct1 · x · 2026-10-31
Cloudflare published a follow-up blog tracking real-world exploitation and patching progress of certificate authority eMudhra's weak keys. The core issue: eMudhra's eight intermediate private keys were shockingly weak — where a 115-digit number was expected, one key was literally the number 4, with the others being 56, 66, 115, 155, 156, 230 and 237.
- Anyone could recover these signing keys almost instantly from the public certificates themselves, then issue certificates for any domain that unpatched clients not enforcing Certificate Transparency would accept.
- This differs fundamentally from past CA compromises like DigiNotar, TÜRKTRUST and TrustWave, where key access was limited to specific attackers; here it was reproducible by anyone.
- eMudhra announced it is exiting the public CA business and blamed a key-generation script mistake, but has not shared the script; it even signed a certificate revocation list (CRL) with one of the weak keys.
- Cloudflare mitigated the issue after learning of it on October 19 and continues monitoring exploitation and patching — the verdict: "not great."
More from Safety
- Claude reportedly stores secret 'suspicion reports' on users after chats — alexcovo_eth · 2026-11-01
- Brazilian Court Sanctions Lawyers for Prompt Injection Hidden in Court Filing — doodlesdev · 2026-11-01
- MCP servers can't tell if clients are under a BAA — a HIPAA compliance gap — SongGongSwim · 2026-11-01
- Black October security roundup: $6.3B Binance heist, Cursor and Fireworks AI among 15+ breaches — teortaxesTex · 2026-11-01
- Leaking secrets from air-gapped PCs via radio signals emitted from RAM — hapax_legomena · 2026-11-01
- Editors Flooded With AI-Assisted Submissions as the Journal Article's Currency Collapses — asusarla · 2026-11-01