Link: https://arstechnica.com/security/2026/10/the-internet-goes-on-high-alert-after-discovery-of-8-compromised-tls-certs/

The compromised eMudhra keys were defective at a level that’s challenging the imagination of many of the engineers studying the incident. A normal size for a NIST P-384 elliptic curve cryptography private key contains roughly 384 bits of entropy, a size allowing almost 2384, or a number with 116 digits, different possibilities. The private key sizes of the compromised keys ranged from 3 to 8 bits. Astonishingly, the private keys were 4, 56, 66, 115, 155, 156, 230, 237.

Anybody else just got troubles with this? At work, we’re just finding out if the certs were trusted and where exactly.

As noted, most browsers have already blocked the intermediate certificates

Doesn’t this require a browser update? Or they already check these certs with some external service which now knows to reject these certs?

Edit: from this link https://ifin.network/t/emudhra-intermediate-certificates-compromised/909

Chrome and Firefox browsers now have updated trust stores that revoke these CAs

Are those trust stores automatically updated? Or does this actually require downloading a browser update? Like a new (minor) version of the software distribution?

My colleague was laughing his head off all morning. Never a good sign when we start laughing a lot, in our office :,D

Astonishingly, the private keys were 4, 56, 66, 115, 155, 156, 230, 237.

Wtaf

OMG, that's what that meme was about?

Exactly what I thought 😄

Remember kiddies, if you don't have an update, you can always manually remove the certs from your local trust store.

I imagine old java keystores or legacy browsers that have self co tai end keystores would be targets for manual fixes.

Astonishingly, the private keys were 4, 56, 66, 115, 155, 156, 230, 237.

This. Is. Bonkers. ROFL

Generally should be, but as people from Mozilla seem to discuss here: https://bugzilla.mozilla.org/show_bug.cgi?id=2083449 remote revocation may have been disabled in firefox so an update was pushed as well. The chrome source in that thread says they did something similar.

Probably best to test your browser here: https://emudhra.we-have-a-problem.com/ (note, it only automatically tests the browser)

Aaaand done.