Eight eMudhra CA Keys Compromised, Browsers and Software Issue Emergency Fixes

On October 17, 2026, a researcher identified as Wayne reported to major browser and root certificate programs that the private keys of eight eMudhra intermediate certificate authority certificates had been compromised. eMudhra is an India-based certificate authority that sells certificates under the emSign brand, with roots trusted by Mozilla, Chrome, Apple, and Microsoft. The compromise affected six TLS intermediates used for website authentication and two code-signing intermediates.

The researcher demonstrated key compromise by signing the message "We have a problem here – Wayne" with each of the eight private keys and submitting cryptographic proof to root program teams. Mozilla independently recovered and verified the private keys on October 17 at 21:48 UTC, confirming the key generation process was flawed. With access to these keys, an attacker could forge SSL/TLS certificates for any website and intercept or impersonate traffic.

Browser makers and root programs responded within hours. Chrome blocked the six TLS intermediates via CRLSet by 19:45 UTC on October 17. Mozilla blocked all eight via OneCRL by 22:59 UTC the same day. Firefox and Chrome users received automatic protection without requiring updates or restarts. Apple blocked the certificates on October 19, and Microsoft on October 20. The root programs notified downstream trust store operators on October 19.

Multiple programming languages and software projects issued emergency updates to reject certificate chains through the compromised keys. Go released versions 1.27.3 and 1.26.10 on October 20, applying the fix to its URGENT track. Electron released patched versions 44.9.1, 43.8.1, and 42.11.16. Python's certifi, Rust's rustls-webpki and webpki-roots, NSS, and other libraries also released updates. Node.js and Composer ca-bundle updates were pending as of October 20.

No evidence emerged that the compromised keys had been used maliciously before discovery. No unauthorized TLS certificates chaining to the six website intermediates appeared in Certificate Transparency logs, suggesting no browser would have accepted them by default. However, the incident created an extensive cleanup burden across the Internet. Systems without automatic revocation checking—Linux distributions, embedded devices, IoT systems, Docker containers, and unmaintained software—would require manual updates or configuration changes to distrust the affected roots. Cryptography experts characterized the remediation effort as larger than the 2014 Heartbleed vulnerability, with a "very, very long tail" of legacy devices and systems.