Eight eMudhra Certificate Keys Compromised, Prompting Browser Blocks and Indian Probe

Eight intermediate certificate authority certificates belonging to eMudhra, an Indian certification authority, had private keys weak enough to be recovered from the public certificates themselves, according to The Next Web. One key was simply the number 4.

The danger extends beyond the keys themselves. An intermediate certificate authority signs other certificates, helping establish which websites and software can be trusted. Ars Technica reported that the compromised keys could allow anyone to mint trusted browser and app credentials.

This was not described as a conventional theft of carefully protected secrets. A researcher recovered the eight keys after discovering they had been generated using predictable numbers, according to Inc42.

On October 19, 2026, at approximately 17:00 UTC, Cloudflare became aware that private keys associated with eight eMudhra intermediate certificates were compromised, according to its account. Those certificates were widely trusted by browsers and operating systems.

On October 20, Mozilla and Google's Chrome Root Program confirmed the compromise of all eight intermediate certificate keys, The Hacker News reported. The discovery prompted emergency fixes across browsers and software.

The extraordinary weakness of the keys became a central part of the story that day. The Register reported that one private key was the number 4, illustrating how little protection the affected certificates offered.

By October 21, eMudhra had revoked the eight compromised intermediate certificates, and Mozilla, Google and Apple had blocked them, according to BleepingComputer. Its report said researchers could recover the keys almost instantly and use them to forge trusted certificates.

Also on October 21, Business Line reported that the flaw had triggered a CERT-In probe. The agency issued an advisory urging users to update browsers and operating systems and replace certificates.

The immediate response is to withdraw trust from the affected certificates. Revocation by eMudhra and blocking by major platform companies address the compromised intermediates, according to BleepingComputer. Those actions should not be confused with evidence that every certificate eMudhra has issued was itself forged or exploited.

The Indian government connection makes the scope particularly important. News reported that websites including Aadhaar issuer UIDAI and the income tax filing portal use eMudhra certificates or other technology from the company. That does not establish that those services were attacked. eMudhra says the incident does not involve a data breach.

The concrete next steps are the updates and certificate replacements called for in the CERT-In advisory, reported by Business Line. Its investigation is also pending.

The supplied reporting does not establish whether attackers used the keys to issue fraudulent certificates before the blocks. It also leaves open how the predictable keys were generated and how the weakness escaped detection.