criticalCertificate authoritycontainedCVSS 9.521 Oct 2026
eMudhra root keys
The keys that prove a website is real were cracked
What happened
Eight intermediate CA certificates were generated with P-384 private keys that were tiny integers — one was literally 4. Anyone could reconstruct the key and mint a trusted certificate for any domain.
Timeline
21 Oct 2026 · 09:30 UTC
Key recovery
Researchers factor the weak P-384 keys in under a second each.21 Oct 2026 · 14:15 UTC
Browser block
Chrome and Firefox ship OneCRL updates blocking the affected intermediates.23 Oct 2026 · 02:10 UTC
Distrust wave
Linux distributions begin removing the eMudhra roots from ca-certificates.
Sources