Developing story. First published October 21, 2026. We will update this page as more information is confirmed; see the update log at the end.
On October 17, 2026, a researcher reported that the private keys of eight intermediate certificate authorities (CAs) run by eMudhra, an Indian CA, could be worked out from the public certificates. The keys were so small that trying fewer than 256 numbers was enough. Chrome and Mozilla blocked the certificates within hours; Apple followed two days later and Microsoft three days later, and eMudhra revoked them. Chrome's removal of the root is still pending. The larger risk is software that is not a browser, such as command-line tools, build pipelines, programming-language runtimes and connected devices, because many of them do not check revocation and keep trusting the old certificates until they are updated.
Summary for leaders
- Who is at risk: Any organization that runs software outside a browser which trusts a built-in list of CAs and does not check revocation. That includes CI/CD pipelines,
curl | shinstallers, server-to-server API calls, containers, Go programs and devices that cannot be updated. Windows code signing is also in scope. Updated browsers are protected now, but Apple and Windows clients were exposed for two to three days after the report. - What is the impact: In theory, an attacker who can sit on the network path could present a forged certificate for any website and read or change traffic from an affected client. No one has reported this happening. It is not known whether anyone tried.
- What to do this week: Update the CA bundles in your operating systems, runtimes and container images, rebuild Go programs with the fixed versions, find the non-browser tools that talk to the internet, and check whether any of your own certificates depend on the affected root. Firefox already rejects it, and Chrome follows on October 27.
What is confirmed
These points come from Mozilla's public incident report, the researcher Scott Helme and several news outlets that agree with them. Figures reported by a single party are labeled as such.
- The flaw. Eight keys, all P-384 elliptic-curve keys, were generated with private values below 256, where a proper key is a 384-bit random number. Mozilla reports it recovered them on its own within about two hours of the report. Helme reports he recovered all eight in under a second. Both figures are self-reported.
- What is affected. Six intermediates that issue website (TLS) certificates and two that issue code-signing certificates, all under eMudhra's
emSign ECC Root CA - G3. Sectigo also cross-signed each one under itsAAA Certificate Servicesroot, so there are 16 certificates in total. - When. The keys were generated on April 30, 2025. A researcher credited by Mozilla as "Wayne" reported them on October 17, 2026. Chrome had a block in place that evening and Mozilla's block followed at about 23:00 UTC. eMudhra revoked the eight certificates on October 18. Apple blocked them on October 19 and Microsoft on October 20. Mozilla removed the
emSign ECC Root CA - G3from its trust list on October 20. - Why, according to eMudhra. A bug in its key ceremony script created a second, weaker key pair on the hardware module. Operators then used the wrong keys, probably because the key names were similar. eMudhra calls this a preliminary account.
- Where the risk remains. Browsers receive revocation automatically. Many other programs do not check it, and Helme's tests found curl, Python and Node accepting a certificate chained to one of the weak keys. Devices that never update could trust these keys until the certificates expire. Sources disagree, giving 2039 or 2040.
- Certificate Transparency. Chrome reported finding no logged TLS certificates chaining to the six TLS intermediates. This only covers certificates that were logged.
What is still in process
- eMudhra's investigation. The root cause is preliminary. eMudhra says it will re-check all of its key ceremonies and report further. Mozilla has also asked about earlier problems with how eMudhra's certificate revocation lists were signed.
- Other roots. Chrome is reviewing eMudhra's other root,
emSign Root CA - G1. Mozilla said it would not remove that root for now. - Chrome's root removal. Chrome has said the
emSign ECC Root CA - G3will be removed in Chrome Root Store version 43, expected to reach devices on October 27. - Software fixes. Reported as of October 21, and changing quickly:
| Software | Reported status |
|---|---|
| Go | Fixes in 1.27.3 and 1.26.10 (CVE-2026-111943, as listed by The Hacker News). Go 1.25 and older get no fix. Programs must be rebuilt. |
| Firefox | 158.0.1, ESR 115.43.1 and ESR 153.5.1 |
| NSS (Mozilla's trust list) | 3.131.1 removes the root |
Python certifi |
2026.10.19 removes the root |
Rust webpki-roots |
1.0.10 removes the root |
PHP Composer ca-bundle |
1.6.0 and 1.4.16 |
| Cloudflare | Client updates released; customers with their own trust stores may need to act |
| Node.js | No fix reported yet; a change is pending |
| Linux distributions, curl, pip, uv, Electron | Status unclear or still being tracked |
Versions and the CVE number are as reported in Mozilla's incident thread and the press coverage listed under Sources. We did not record a vendor link for each row, so confirm each one against the vendor's own release notes before relying on it. We have not tested these fixes ourselves.
- Customer migration. eMudhra has stopped issuing from the affected hierarchy and is moving customers to replacements. A single Mozilla comment estimates about 30,000 certificates need to move off the root, mostly through automated renewal. That is an unverified estimate and covers the whole root, not only the eight keys.
What we do not know
- Whether anyone used the keys to forge a certificate. No misuse has been reported.
- Whether eMudhra issued any certificates from these intermediates. eMudhra says only one was in production and none issued end-entity certificates. An earlier statement in Mozilla's thread said one TLS intermediate was live and was disabled. This is the company's claim and we have not verified it.
- How many customers, and which, were affected.
- Whether other eMudhra keys, such as its RSA keys, are sound. Mozilla had not finished checking them.
- The role of AI. Helme says an AI agent recovered the keys from a single prompt. eMudhra says the weakness could be found "possibly with AI-assisted techniques." Neither claim is independently verified.
- Who found the flaw first. eMudhra credits an independent researcher; Mozilla says it recovered the keys itself after the report. These are not the same claim and we draw no conclusion.
Actions for this week
| # | Ask your team to... | What done looks like |
|---|---|---|
| 1 | Update CA bundles: operating system ca-certificates, certifi, Node, Homebrew and similar. Rebuild container images once their base images update |
A list of images and hosts updated, with dates |
| 2 | Rebuild Go programs with Go 1.27.3 or 1.26.10, and plan to move off Go 1.25 and older | Rebuilt binaries deployed; a list of those that cannot move yet |
| 3 | List the non-browser clients that make outbound HTTPS calls: installers run with curl | sh, CI/CD pipelines, package managers, server-to-server APIs |
A short inventory with an owner for each |
| 4 | Check whether your own website or API certificates chain to emSign ECC Root CA - G3. If they do, install a certificate from a different hierarchy now. Firefox and other NSS-based clients already reject this root (since October 20), and Chrome follows on October 27 |
Each certificate's issuer recorded; replacements installed |
| 5 | List devices that cannot be updated, such as routers, printers, TVs and appliances with frozen firmware | A list, with a plan to replace, isolate or accept each one |
| 6 | Check whether any software or drivers you rely on are signed by the two affected eMudhra code-signing CAs (EM OV CS CA - G3B and G3C). Microsoft reported blocking them on October 20; confirm the block has reached your Windows fleet through updates. Remove trust manually only where updates lag | A list of signed items found, the Windows update level of the fleet, and a decision for any gaps |
| 7 | Do not assume revocation protects you. Turn on revocation checking where your tools support it, and avoid running unverified installers on machines with production access | A short rule shared with engineering |
| 8 | Write up what was checked, found and changed, for your board, auditor or customers | A note for your board, auditor or customers: what was checked, what was found, what changed |
Technical details
Affected intermediates (all under emSign ECC Root CA - G3; each also exists as a Sectigo cross-signed copy):
- EM DV TLS CA - G3B and G3C
- EM OV TLS CA - G3B and G3C
- EM EV TLS CA - G3B and G3C
- EM OV CS CA - G3B and G3C (code signing)
The full list of certificates, with CCADB entries and hashes, is in Mozilla's incident report. We have not reproduced the CCADB ID ranges here because the ranges quoted in early coverage did not match the 16 certificates, and they should not be used as a blocklist. Browser blocks are keyed to the public key, so they also cover the cross-signed copies.
Why checks miss it. The public keys are valid points on the curve and pass structural checks. The only way to detect the flaw is to try to recover the private key.
What a recovery looks like. A key is a number d. The public key is d × G. If d is tiny, calculating 1 × G, 2 × G and so on until one matches the public key finds it in a fraction of a second.
For full lists, hashes and discussion, use Mozilla's incident report and the researchers' sites below.
Update log
- October 21, 2026: Revised before review: corrected browser timing, root-removal dates and action wording; removed unreconciled CCADB ranges; labeled single-source figures.
- October 21, 2026: First published. Based on the sources below as of this date.
Sources
- Scott Helme, October 20, 2026: Eight Bits of Trust: eMudhra's CA keys cracked in milliseconds
- Mozilla Bugzilla incident report: Bug 2083449, private key compromise of eMudhra intermediate certificates
- The Hacker News, October 2026: Eight eMudhra CA keys compromised, triggering emergency fixes across browsers and software
- BleepingComputer: Mozilla, Google, Apple block compromised eMudhra CA certificates
- CoinDesk, October 21, 2026: Internet panics after 8 eMudhra private keys get cracked
This advisory is based on public reporting and Mozilla's incident thread, and it may change as more is learned. The actions are our own recommendations, not those of Mozilla, the researchers or the news outlets. We did not test any fix ourselves.