Multiple outlets report that eight eMudhra intermediate certificate authority (CA) certificates have been compromised, with Cloudflare and browser stakeholders describing weak or exposed keys used for signing. Because intermediate CAs underpin the certificates websites present, anyone with the affected keys could issue fraudulent HTTPS certificates for domains accepted by client software.
Cloudflare says it is deploying mitigations and releasing client updates after the issue is discovered, and it outlines what customers and developers should do next. LWN and other reports describe how Mozilla has blocked the certificates via OneCRL and updated its trusted certificate list, alongside timing of blocks across different platforms.
Dark Reading and other coverage emphasizes that major technology firms moved quickly to block the certificates, though outlets note uncertainty about how the keys were compromised. Hacker News focuses on the emergency response across browsers and software, citing confirmations tied to Mozilla and Google’s Chrome Root Program.
