Mozilla, Google, Apple block compromised eMudhra CA certificates
Mozilla, Google, and Apple revoked trust in eight eMudhra intermediate CA certificates after researchers proved the private keys were so weak they could be recovered almost instantly — a reminder to audit CA trust chains across the enterprise.
Summary written by editorial AI · Source link below
Certificate authority eMudhra revoked eight compromised intermediate certificates after researchers found their private keys were so weak that anyone could recover them almost instantly and use them to forge trusted certificates for legitimate websites. [...]
Editorial Analysis
A trusted CA issuing certificates with trivially recoverable keys threatens TLS integrity across the web; enterprises must verify their trust stores exclude these intermediates and review CA vendor-risk assumptions.
Immediately verify that all managed browsers, servers, and trust stores have blocked the compromised eMudhra intermediates and audit your CA vendor-risk assessments.
A certificate authority trusted by all major browsers issued certificates with private keys anyone could recover — major browser vendors have revoked trust.
Forward-looking interpretation drafted by editorial AI under human review — not a reproduction of the source. See methodology.
External link — opens at BleepingComputer in a new tab.
More from the Vulnerabilities Desk
- Unpatched Tailscale SSH Flaws Could Let a Hacked Device Reach Root on Other Servers1d
- Brotli Decoder Flaw Behind Node.js RCE Also Affects Bun, Python and Other Widely Used Software2d
- Abandoned Popcorn Time app exposed millions of devices to RCE attacks3d
- HPE patches eight max severity RCE and auth bypass AOS flaws3d
- Compromised TLS Certificates3d