The private keys behind eight intermediate certificates from certificate authority eMudhra were generated so weakly that anyone can recover them, and the cleanup is now spreading from browsers to the servers, apps and containers that rely on the same trust chains. Cloudflare said in a blog post on October 20, 2026, that an attacker holding the keys “can create a forged certificate for any domain and use it to impersonate servers to intercept or modify traffic,” and called it “a serious security incident with implications across the Internet.”

Mozilla received the first report on Saturday, October 17, at 20:06 UTC and had blocked the certificates for Firefox users through its OneCRL revocation list by 22:59 UTC, according to the Mozilla Security Blog . In the Bugzilla incident report , Mozilla’s Dennis Jackson wrote that the affected P-384 keys, created on April 30, 2025, “all used integers less than 256,” which lets them be recovered almost instantly.…