eMudhra Security Compromise Exposes 8 Certificate Keys That Can Be Cracked in Seconds

The private keys behind eight eMudhra intermediate certificate authority certificates have been compromised, prompting emergency blocks across major browsers and software platforms. The affected certificates chain to roots trusted by Mozilla, Microsoft, Apple, and Chrome, placing clients that still accept them at risk of trusting forged certificates.

However, the public disclosures reviewed do not establish that these keys can be cracked in seconds. They confirm that a researcher demonstrated control of the keys, not how they were obtained or how quickly any cryptographic attack could recover them.

A researcher identified as Wayne reported the compromise to root program teams on October 17, 2026. To demonstrate access, Wayne signed the message “We have a problem here – Wayne” using each affected intermediate CA private key.

The disclosure site, published by Dennis Jackson, provides certificates, public keys, and signatures for independent checks. Researchers can use OpenSSL to extract a certificate’s public key and verify the corresponding signature. This proves signing capability without requiring publication of the private keys themselves.

An intermediate certificate authority helps connect a website’s certificate to a trusted root. If its signing key is exposed, an attacker may create certificates that vulnerable clients accept as genuine. Mozilla warned that someone able to intercept a connection could use fraudulent certificates to impersonate websites and potentially read or change traffic.

The risk echoes earlier reporting on unauthorized HTTPS certificates obtained through compromised domain registries and misissued TLS certificates affecting the 1.1.1.1 DNS service. Those cases involved different failures, but show why certificate trust is a security concern beyond the browser padlock.

Browsers Block Certificates as Software Updates

Mozilla received the report at 20:06 UTC on October 17 and completed its OneCRL blocklist rollout by 22:59 UTC. Standard Firefox configurations received protection without requiring a browser update or restart, according to Mozilla’s incident statement.

The disclosure site says Chrome also blocked the affected certificates on October 17. Apple followed on October 19, while Microsoft’s protection arrived on October 20. eMudhra has also revoked the compromised intermediate certificates.

Revocation alone does not protect every application. Some clients do not receive browser blocklists or check whether a certificate has been revoked. These programs need separate updates to stop accepting the affected certificate chains.

Mozilla released Firefox 158.0.1, ESR 115.43.1 and ESR 153.5.1 to cover users whose settings could prevent OneCRL delivery. Its NSS 3.131.1 update also removes the signing root from the trusted certificate list used by other applications.

The incident response page lists fixes including Go 1.27.3 and 1.26.10, Python certifi 2026.10.19, and Rust webpki-roots 1.0.10. Node.js and Composer ca-bundle updates were listed as pending when the page was reviewed.

Users should update browsers and operating systems promptly. Developers should also check certificate bundles shipped with applications rather than assume an operating system update covers every runtime.

Administrators can use the disclosure site’s test endpoints and certificate chains to assess remaining exposure. A certificate rejection indicates that the tested client refuses the affected chain. Manual root removal should remain an expert measure because it can disrupt legitimate connections.

The verified finding is a serious signing key compromise. The available evidence does not establish a seconds-long cracking method or confirm attacks against users. How the keys became exposed remains publicly unconfirmed.

An EDR alert reveals an attack. But can it tell the full story? Discover how to reconstruct the attack timeline.

The post eMudhra Security Compromise Exposes 8 Certificate Keys That Can Be Cracked in Seconds appeared first on Cyber Security News.