poslední zpráva
SPOJENO AI EPSS 0.00 (nejvyšší)
Mozilla, Google, Apple block compromised eMudhra CA certificates
Certificate authority eMudhra revoked eight compromised intermediate certificates after researchers found their private keys were so weak that anyone could recover them almost instantly and use them to forge trusted certificates for legitimate websites. [...]
eMudhra Qualys Sectigo curl Mozilla Microsoft Google Apple US IT BE
CVE v události 2
| CVE | hodnocení | KEV | EPSS |
|---|---|---|---|
| CVE-2026-111943 | – | – | 0.00 |
| CVE-2026-111944 | – | – | – |
Hodnocení z katalogů, všechna, se stupnicí CVSS a vydavatelem. Rozpad vektoru je na stránce CVE.
Jak se o tom psalo 8
-
· Qualys US
How to Identify Compromised eMudhra Certificates With Qualys (CVE-2026-111943 and CVE-2026-111944)
Executive Summary A critical certificate authority incident disclosed on October 17, 2026, impacts eight eMudhra intermediate CA certificates. A flaw in the key generation process could allow attackers to recover private keys and issue fraudulent TLS or code-signing certificates. The affected intermediates have been revoked and blocked by major platform vendors, including Chrome, Mozilla, Apple, and Microsoft. The issue is tracked as CVE-2026-111943 and CVE-2026-111944. The eMudhra Certificate…
-
· Cisco PSIRT US
Cisco Informational for Emergency Distrust of eMudhra Root and Intermediate Certificate Authorities
Between October 17 and October 20, 2026, a critical security compromise involving Certificate Authorities that are managed by eMudhra was uncovered. A security researcher demonstrated that the private keys for eight eMudhra intermediate certificates were fundamentally broken due to an unprecedented error in their Key Generation Ceremony (KGC) in April 2025. This allows anyone to brute-force acquire these private keys within seconds. For more information, see eMudhra Intermediate CA Compromise…
-
· CSIRT Itálie (ACN) IT
Compromissione di chiavi private associate a certificati CA intermedi eMudhra
È stata resa pubblica la compromissione delle chiavi private associate ai certificati di otto autorità di certificazione (CA) intermedie di eMudhra , sei destinate all'emissione di certificati TLS e due alla firma del codice. Risultano interessate anche le corrispondenti versioni dei certificati intermedi oggetto di certificazione incrociata (cross-signing) da parte di Sectigo.
-
· The Record US
Indian tech company eMudhra announces withdrawal from certificate business after security incident
The issue was publicized by cybersecurity researcher Scott Helme, who published a blog saying that instead of a random 384-bit number, one of the company's private keys was just the number four.
-
· Palo Alto Unit 42 US
EMudhra Intermediate CA Certificates Compromised
Eight compromised eMudhra intermediate CA private keys risk unauthorized TLS signing and MitM interception. Read our analysis and containment guide. The post EMudhra Intermediate CA Certificates Compromised appeared first on Unit 42.
-
· Aikido Security BE
eMudhra CA compromise: eight private keys, and one of them is 4
Eight eMudhra CA keys could be guessed in at most 256 tries, and one is just the number 4. Who is affected, why curl lagged browsers, and how to fix it. Category: Vulnerabilities & Threats
-
· Cisco Talos US
Compromised eMudhra intermediate certificates
Cisco Talos is aware of eight intermediate certificates belonging to the intermediate certificate authority, eMudhra. Rather than possessing the mandatory 384 bits of pseudo-random security, several private keys evaluated single-digit and double-digit integers. This misconfiguration allows an attacker with the private key of any of the compromised intermediate CAs to impersonate any website or service. Six of the TLS certificates, trusted by Chrome, Mozilla, and Apple have been blocked by these…
-
· BleepingComputer US nadpis události
Mozilla, Google, Apple block compromised eMudhra CA certificates
Certificate authority eMudhra revoked eight compromised intermediate certificates after researchers found their private keys were so weak that anyone could recover them almost instantly and use them to forge trusted certificates for legitimate websites. [...]