Mozilla and Google confirmed that keys behind eight eMudhra certificates are compromised. Browsers blocked them fast, but other software may still trust them.
Mozilla and Google's Chrome Root Program confirmed on October 20 that the private keys for eight certificates from eMudhra, an Indian certificate company, are compromised. Chrome and Firefox blocked the certificates within hours of a researcher's report. The bigger worry is other software that does not get blocks pushed to it the way browsers do.
A certificate authority is a company that vouches that a website is genuine. An intermediate one signs the certificates that websites show your browser. Anyone holding one of these eight keys could issue a certificate for any website that a browser would accept. That is how a fake bank or login page could look safe.
The keys were not stolen in the usual sense. They were made with too little randomness, so anyone can work them out from the public certificates. eMudhra said a flaw in the April 2025 ceremony that created the certificates produced a second, weak set of keys. Researchers have since published the keys.
Browser users are in good shape. Chrome and Firefox fetch block lists on their own, so neither needed an update or a restart. Apple blocked the certificates on October 19 and Microsoft on October 20. Android got a block through Google Play Services on October 19. Chrome also said no website certificate from the six website-related intermediates had been logged publicly before its block, so none could have been trusted by default.
Mozilla does not believe, for now, that other certificate companies are affected. Chrome said it checked every other one in its store and found no other cases.
Many programs that check website certificates do not look at block lists. They keep trusting a certificate until their code or their bundle of trusted companies changes. The material names programs built with Go and tools using Python's certifi bundle as examples. Go released a fix on October 20, but a program only gets it when it is rebuilt. Go 1.25 and older get no fixes.
Some fixes work by removing whole trusted companies from software lists. That also cuts off legitimate sites that rely on them, so some servers may become unreachable for some tools.
The steps in the alert box above cover the practical side. In short, update browsers and business software, and ask your IT provider whether any of your tools rely on eMudhra certificates.
Whether anyone used the flaw since the certificates were created in April 2025 is not known. Go treated its fix as urgent, but neither its issue nor its release notes say whether that was for ecosystem safety or for attacks already happening.
Browsers already blocked the eight certificates, so update them anyway and ask your IT provider about other software that may still trust eMudhra.
A viral ChatGPT prompt turns what the chatbot remembers about you into a room image. Posting it publicly could give scammers clues to target you.
Read more: Viral ChatGPT room image could hand scammers clues about youA message saying your Amazon account was hacked is often the scam itself. Checking in the Amazon app first can protect your card, gift balance and phone.
Read more: If Amazon says your account was hacked, check before you callThe Attala County Sheriff's Office in Mississippi says scam calls are reaching residents, and a call that sounds official may not be.
Read more: Mississippi sheriff warns residents about scam phone calls
