Two Web Emergencies in One Week: Guessable Certificate Keys and Critical PHP Bugs that Leaked Before Patches
The advisory says eight affected intermediates could let attackers recover keys and issue fake website certificates, prompting Google and Mozilla to block them.
- India's Computer Emergency Response Team, known as CERT-In, issued a security advisory on October 21 flagging a vulnerability in cryptographic keys used by eight intermediate certificate authorities linked to eMudhra, posing risks for website impersonation.
- An error in a script used to generate cryptographic keys left the eight intermediate authorities with insufficient randomness, allowing private keys to be discovered by testing just 256 possible numbers.
- According to Bleeping Computer, Google, Apple, and Mozilla have blocked the affected certificates to prevent browsers from accepting fraudulent certificates that could impersonate legitimate websites.
- Users should update their browsers and operating systems, while businesses must verify their own certificate dependencies; CERT-In urged organizations to apply necessary security measures beyond routine updates.
- Mozilla cryptography engineer Dennis Jackson warned that Macs may continue trusting compromised certificates because macOS does not check revocation information, suggesting Apple may need an upcoming security update.
53 Articles
53 Articles
Security flaw: eMudhra shares take a hit, fall 20%
The flaw occurred during a key-generation ceremony on April 30, 2025, when a second set of weak keys was generated alongside the original strong keys. Mozilla cryptography engineer Dennis Jackson reported the issue on Oct 17, flagging insufficient randomness that made the keys vulnerable to recovery. eMudhra said it was investigating the root cause.
eMudhra shares hit lower circuit as browsers revoke compromised digital certificates
Shares of eMudhra fell by 20%, hitting the lower circuit, following the disclosure of a critical security vulnerability in its digital certificate issuance process. The stock market reaction underscores the severity of the flaw, which has raised significant concerns regarding the integrity of the company's trust infrastructure. Technical researchers highlighted a compromise in the certificates, warning that the vulnerability could be exploited b…
What Is The eMudhra Security Flaw? 8 Weak Digital Certificates Raise Fake Website Fears
Recently, the Indian cybersecurity company called eMudhra became subject to discussion when researchers revealed that there is a serious threat associated with eight certificates, issued by this company. These certificates are considered to be insecure since the private keys for these
Coverage Details
Bias Distribution
- 37% of the sources are Center, 37% of the sources lean Right
Factuality
To view factuality data please Upgrade to Premium
