Eight private keys behind eMudhra intermediate CAs turned out to be single-byte numbers, guessable in milliseconds. Chrome and Firefox blocked them the same day. Your base image, your Python bundle and your JVM keystore blocked nothing until someone rebuilt them.

TL;DR (for non-technical readers)

A certificate authority, one of the organizations that vouch for websites being genuine, created eight signing keys so weak that anyone could have worked them out.

Web browsers shut the door within hours. But servers, scripts, build systems and apps keep their own list of who to trust, and those lists do not update themselves.

The risk for a business is that an attacker could impersonate a trusted service to your software, not to your customers' browsers.

Ask your tech team: "Where do our services get their list of trusted certificate authorities, and when was it last refreshed?"

What happened

The facts, from eMudhra's statement , Scott Helme's analysis and the dev.to summary :

A researcher reported on…