eMudhra intermediate CA key compromise triggers browser blocks
Original title: eMudhra Certificate Authority Compromise Triggers Emergency Action Across Browsers
Eight intermediates chaining to major browser roots were blocked; attacks on users are not confirmed.
Private keys for eight eMudhra intermediate certificate authorities were compromised, and a researcher named Wayne showed control by signing a message with each key in a report to root programs on October 17, 2026. The certificates chain to roots trusted by Mozilla, Microsoft, Apple, and Chrome. Mozilla finished a OneCRL block the same day; Chrome blocked them October 17, Apple October 19, and Microsoft October 20. eMudhra revoked the intermediates. How the keys were exposed, and whether users were attacked, is not confirmed.
Unconfirmed: How the keys were obtained is unconfirmed, and the report does not confirm attacks against users or a fast cryptographic crack.
- Wayne signed “We have a problem here – Wayne” with each affected key.
- Mozilla received the report at 20:06 UTC and finished OneCRL by 22:59 UTC.
- Firefox 158.0.1, ESR 115.43.1, and ESR 153.5.1 cover missed OneCRL delivery.
- NSS 3.131.1 drops the signing root; Go 1.27.3 and 1.26.10, certifi 2026.10.19, and webpki-roots 1.0.10 are listed fixes.
- Node.js and Composer ca-bundle updates were still pending when the page was reviewed.
Impact: Forged certificates that trusting clients may accept as genuine
| Product | Affected |
|---|---|
| eMudhra intermediate certificate authority certificates | eight compromised intermediates |
- 1.Install Firefox 158.0.1 or the named ESR builds, and update Chrome, Apple, and Microsoft clients.
- 2.Apply NSS 3.131.1, Go 1.27.3 or 1.26.10, certifi 2026.10.19, and webpki-roots 1.0.10.
- 3.Check application certificate bundles; Node.js and Composer updates were still pending.
- Organizations
- Mozilla
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| ipv4 | 1.1.1.1 | ain registries and misissued TLS certificates affecting the 1.1.1.1 DNS service . Those cases involved different failures, but |
From the original article
3 min read at cybersecuritynews.com
The private keys behind eight eMudhra intermediate certificate authority certificates have been compromised, prompting emergency blocks across major browsers and software platforms. The affected certificates chain to roots trusted by Mozilla, Microsoft, Apple, and Chrome, placing clients that still accept them at risk of trusting forged certificates. However, the public disclosures reviewed do not establish […]
By Guru Baran · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.