Cloudflare tracks forged certificates from eMudhra’s weak CA keys
About 22,000 handshakes presented the weak keys; Cloudflare says none intercepted its own connections.
88
- Mentions · 7d5
- Mentions · 30d37
- All mentions46
- First seenSep 4, 2026
- Last mentioned7h ago
Timeline
46 articles · newest firstQualys CISO urges tracking exposure window over MTTR
Qualys TRU says 357 of 48,172 flaws disclosed in 2025 were remotely exploitable and weaponized.
28
Google fixes 52 Chrome flaws, including four critical bugs
Stable builds move to 156.0.8078.73/.74 on Windows and Mac and 156.0.8078.73 on Linux, with no exploitation stated.
68
Blog argues rapid disclosures leave defenders unable to keep up
A week of KVM, PHP, CA, and Brotli issues shows fixes arrive faster than inventory, assessment, and rollout.
28
Indian government sites still serve revoked eMudhra certificates
Of 8,947 IGOD hosts checked on October 23, 156 still presented certificates revoked on October 19.
74
Okta and Auth0 are removing trust in eMudhra emSign ECC Root CA – G3
Derived keys for eight intermediates can mint certificates for any domain; Okta reports no exploitation.
74
Okta and Auth0 are removing trust in eMudhra emSign ECC Root CA – G3
Derived keys for eight intermediates can mint certificates for any domain; Okta reports no exploitation.
74
Comodo AAA Services root and S/MIME raised on oss-security
The October 22 post is truncated after Böck says he asked Mozilla what earlier messages meant.
18
eMudhra exits certificate business after weak intermediate keys
Eight intermediate keys were trivial values; browsers blocked them, and the firm says nothing was breached.
78
eMudhra exits global SSL/TLS issuance after weak CA private keys
Eight intermediate CA keys were tiny integers, including 4; the firm says none issued end-entity certificates.
64
eMudhra exits global SSL/TLS business after weak intermediate CA keys
Mozilla and Google blocked eight weak intermediate keys on October 17; those CAs issued no end-entity certificates, while about 30,000 others need migration.
72
Node.js patches Brotli decoder bug that may allow code execution
Fixed builds are 22.23.4, 24.22.1, and 26.12.1; a public proof of concept did not achieve code execution on a standard build.
76
October 21 fixes cover PHP2Shell, LiteLLM theft, and VPN attacks
Fixed PHP builds are 8.5.12, 8.4.27, 8.3.36, and 8.2.35; LiteLLM 1.107.0 stole secrets, so pin 1.106.2 and rotate them.
86
GoDaddy revokes 404,607 SSL certificates after profile mismatch
Revocation took effect October 21, 2026, and sites still serving those certificates can fail browser TLS checks.
58
Weak eMudhra intermediate keys can impersonate sites; vendors block them
Go 1.27.3 and 1.26.10 distrust eight weak intermediates as CVE-2026-111943; Talos reports no malicious use yet.
78
eMudhra CA signing keys were so weak anyone could recover them
Eight intermediates from an April 2025 ceremony used keys under 256; browsers blocked them, and about 30,000 customer certificates need replacement.
86
Google and Mozilla revoke eight eMudhra intermediates after weak keys
Keys were trivially recoverable from public certificates; Google saw no chaining TLS certificates in CT logs before blocking.
80
Weak eMudhra keys expose eight trusted intermediate certificates
All eight P-384 private keys were integers below 256 and could be recovered from public certificate data.
78
Eight eMudhra intermediate CA private keys compromised
The intermediates chain to roots in major browser programs, so bundled trust stores need updates.
90
eMudhra CA private keys compromised, one was the number 4
Mozilla, Chrome and Apple are distrusting eight intermediates after keys such as 4, 56 and 115 were recovered in under a second.
86
Eight eMudhra intermediate certificate keys compromised, Cloudflare says
Cloudflare says it has not seen exploitation on its services and has shipped client and tunnel updates.
88
Mozilla opens its eMudhra intermediates tracking bug to the public
Alan Coopersmith says restrictions on Mozilla bug 2083449 were removed on October 20.
22
eMudhra intermediate CA key compromise triggers browser blocks
Eight intermediates chaining to major browser roots were blocked; attacks on users are not confirmed.
84
Chrome and Firefox drop eMudhra root after certificate compromise
Whether Edge, Internet Explorer, cURL, and other private root stores still trust eMudhra is unconfirmed.
62
Mozilla alerts Firefox users after eMudhra intermediate compromise
The notice reached the distros list a day before this oss-security forward and points to a Mozilla security post.
70
Ubuntu removes emSign ECC Root CA - G3 after CA compromise
22.04, 24.04 and 26.04 LTS also refresh ca-certificates to the Mozilla 2.90 authority bundle.
54
Mozilla security advisory (AV26-1057)
Canada’s Cyber Centre urges updates for Firefox, Firefox ESR, and Thunderbird flaws fixed in October 2026 releases.
32
Bank of America had to bring in 1,000 contractors to patch all the bugs Mythos identified
Bank of America hired 1,000 contractors to patch Anthropic Mythos findings amid large AML penalties.
62
Firefox Enterprise Adds DLP and AI Controls to Block Sensitive Data Leaks
Mozilla launched Firefox Enterprise 158 with self-hosted admin controls, built-in DLP, and restrictions on AI data sharing.
42
VU#948176: Multiple TLS Libraries can Bypass Delegation Enforcement
CERT/CC says TLS libraries inconsistently enforce Name Constraints, with three assigned CVEs already fixed.
64
Open models have real benefits. Do they outweigh the risks?
MIT Technology Review weighs open-model benefits against misuse risks highlighted by Anthropic.
52
Hackers Use Fake Firefox Wallet Extensions to Steal Crypto Recovery Phrases
Sixteen malicious Firefox extensions impersonated crypto wallets and stole recovery phrases via Cloudflare Workers.
62
16 Malicious Firefox Extensions Impersonate Crypto Wallets to Steal Seed Phrases and Private Keys
Sixteen malicious Firefox extensions impersonating Rabby and OKX crypto wallets stole seed phrases and private keys, exfiltrating them to attacker-controlled Cloudflare Workers.
50
16 Malicious Firefox Extensions Pose as Rabby and OKX Wallets to Steal Recovery Phrases
Sixteen malicious Firefox extensions impersonating Rabby and OKX wallets stole recovery phrases via Cloudflare Workers.
64
100 days later: Microsoft still steers Windows and Copilot users to Edge
Mozilla says Microsoft still steers non-EEA Windows and Copilot users toward Edge, 100 days after its report.
32
Mozilla shutting down Solo AI website creator
Mozilla will shut down Solo and permanently delete all sites and data on November 30, 2026.
30
Cloudflare Launches Free Certificate Authority for the Whole Internet
Cloudflare is seeking approval to run a free public CA with ACME and post-quantum certificates.
48
Post-quantum website certificates from Cloudflare are scheduled for early 2027
Cloudflare will become a public certificate authority and plans post-quantum Merkle Tree Certificates in early 2027.
52
Interview: Firefox's chief on why he hopes a redesign will help win users from Chrome
Mozilla's Ajit Varma discusses Firefox 157's redesign, aiming to grow market share beyond privacy-focused users in a Chromium-dominated browser market.
3
Building a certificate authority for the whole Internet
Cloudflare will become a public certificate authority, acquiring GlobalSign's trusted root and applying to Chrome, Apple, Microsoft, and Mozilla root programs, with post-quantum certificates planned.
62
Related CVEs
by mentions- CVE-2026-11149783%9.2Buffer overflow in Google Brotli decoder 1.0.3–1.2.0
- CVE-2026-109619100%9.2Use-after-free RCE in PHP via stale request globals
- CVE-2026-109618100%9.2OOM longjmp memory flaw enabling RCE in PHP
- CVE-2026-99999<1%9.3Linux kernel IPv4 checksum metadata can corrupt headers
- Missing authorization in Google Chrome Video before 156.0.8078.73
- Auth bypass in Apache Tomcat JNDIRealm with non-GSSAPI SASL
- Improper input validation in Chrome Skia before 156.0.8078.73
- Memory corruption in Google Chrome before 156.0.8078.73
- Memory corruption in Chrome WebAudio via crafted HTML
- A flaw in Node.js Permission Model filesystem enforcement can grant access to paths that do not match a wildcard `--allow-fs-read` or `--allow-fs-write` rule
Appears with
- eMudhravendor · 18
- Firefoxproduct · 14
- Googleorganization · 13
- Mozillavendor · 12
- Appleorganization · 11
- Cloudflareorganization · 10
- Googlevendor · 8
- Chromeproduct · 7
- Microsoftorganization · 6
- Microsoftvendor · 6
- Cloudflarevendor · 5
- emSign ECC Root CA – G3product · 4
- Anthropicorganization · 4
- Socketorganization · 4
- Anthropicvendor · 3
- NSSproduct · 3
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.