Private keys for eight eMudhra intermediate certificate authority (CA) certificates were compromised, allowing attackers to forge trusted digital identities across major platforms. The breach, confirmed by security researcher Wayne on October 17, 2026, involved keys that chain to root certificates trusted by Mozilla, Microsoft, Apple, and Google ecosystems.

Technical validation was demonstrated through signed messages distributed to root program teams, with proof files containing certificates, public keys, and corresponding signatures. Verification required standard cryptographic checks using OpenSSL utilities to confirm key compromise.

Compromised intermediates were immediately blocked across affected platforms: Firefox and Chrome implementations were updated on October 17, Apple devices received patches on October 19, and Microsoft systems followed on October 20. The incident triggered coordinated responses from major browser vendors and operating system maintainers, who distributed revocation tools including OneCRL, CRLite, and CRLSets to mitigate the vulnerability.

The root cause appears to stem from improper private key generation by eMudhra itself, creating predictable cryptographic material that could be extracted from publicly available certificates. This flaw potentially existed since April 2025, though Certificate Transparency logs show no evidence of exploitation by browsers enforcing CT requirements.

Impact extends beyond browser environments, as numerous non-browser applications and operating systems continue to trust the compromised intermediates without automatic revocation mechanisms. Distributions across Linux, macOS, and other platforms have released updated trust stores, though some users may require manual configuration changes.

Security experts recommend immediate system updates for all users, particularly those operating in environments handling sensitive transactions. Developers maintaining software dependencies should verify their certificate bundles against the latest trusted root lists, with specific guidance available through package manager updates across major platforms.

The incident underscores persistent challenges in certificate authority security and the critical importance of robust key management practices, even within established cryptographic infrastructures.