On October 17, 2026, browser security teams were informed that eight private keys belonging to eMudhra’s digital certificates had been compromised. eMudhra is an Indian company that provides digital security certificates.  

In our blog, we will break down what happened, its impact on organizations, and what they can do to defend.

Eight private keys compromised: How did eMudhra and browser vendors respond?

Security researchers have found that eight private keys associated with eMudhra have been compromised due to insufficient cryptographic randomness during key generation.

The keys were supposed to be extremely difficult to guess, but they weren’t. When a security researcher, Scott Helme, made an attempt to recover them, he was able to recover several of them in less than a second.

This means that anyone with the keys could potentially create fake certificates for the websites and make them appear trustworthy to browsers.

Six of the affected certificates were used for TLS/HTTPs certificates, and two were used for code signing. An attacker with access to these keys can create an impersonated website and intercept encrypted communications.  

Browser vendors and software maintainers responded by blocking the affected certificates and issuing security updates.

Google Chrome and Mozilla Firefox have blocked the affected certificates within hours of being notified.

Apple and Microsoft followed over the next few days.  eMudhra revoked all eight certificates, and Mozilla has already removed the root certificates.

No malicious use of the affected TLS certificates has been reported. However, this does not rule out every form of misuse.

About the threat

How does it impact organizations?

Successful abuse of the compromised keys could allow attackers to:

• Impersonate legitimate websites by issuing fraudulent TLS certificates for domains they do not control.
• Intercept or modify encrypted communications through an active adversary-in-the-middle attack against affected clients.
• Exploit trust in digital certificates to make malicious websites appear authentic.
• Abuse code-signing trust, potentially making malicious software appear to have a valid signature if affected signing certificates are accepted.
• Impact applications and devices with outdated trust stores, including systems that do not automatically receive certificate revocation updates.

The actual impact depends on whether a target system continues to trust the affected certificates, the available attack position, and the specific application’s certificate validation behavior.

Notable Threat Behaviors

• Cryptographic key weakness: The affected private keys reportedly had extremely low entropy, making recovery possible.
• Fraudulent certificate issuance: Compromised intermediate CA keys could be used to create certificates for domains outside the certificate holder’s control.
• TLS trust abuse: Fraudulent certificates could be used in active interception attacks against clients that continue to trust the affected certificates.
• Code-signing trust risk: Two compromised intermediate certificates were associated with code signing, creating a separate potential software-authenticity risk.
• Trust-store remediation: Browser vendors and software projects are distributing blocks or updates to prevent the affected certificate chains from being trusted.

Official security guidance

• Google, Mozilla, and other software maintainers have taken steps to block the affected certificates or remove trust in relevant certificate authorities. The available remediation differs by platform and application.
• Organizations should update affected browsers, operating systems, certificate stores, and application runtimes. Applications that bundle their own certificate authorities or do not consume revocation information may require separate updates or rebuilds.

SharkStriker’s Recommendations

Customers should prioritize remediation of outdated browsers, application runtimes, and independently maintained trust stores, as updating a browser alone may not protect every application or device.

Here’s what we recommend:

• Update browsers and operating systems: Deploy the latest security updates to ensure the relevant certificate revocation or distrust protections are applied.
• Update application-specific trust stores: Identify applications and runtimes that maintain their own CA bundles, including Python certifi, Rust webpki-roots, and other bundled certificate stores. Apply the relevant vendor or maintainer updates.
• Update and rebuild Go applications: Upgrade to the fixed Go releases, 1.27.3 or 1.26.10, as applicable, and rebuild affected applications so the certificate rejection logic is included. Confirm the appropriate supported release for each environment.
• Review certificate dependencies: Identify systems, services, VPNs, proxies, containers, and embedded devices that rely on the affected eMudhra intermediate certificates or associated trust chains. Replace affected certificates and migrate to trusted replacement chains where required.
• Investigate suspicious certificate use: Review available TLS inspection, proxy, Certificate Transparency, and application logs for unexpected certificates, unusual certificate chains, or potential interception activity. Do not treat the absence of a Certificate Transparency finding as proof that no misuse occurred.