Critical PKI/TLS Certificate Vulnerability (eMudra Incident)
A severe certificate authority compromise has been discovered: intermediary certs were issued with single-byte P-384 private keys, allowing anyone to forge valid TLS certificates locally. The issue may have gone undetected since 2025 and affects all software bundling CA cert roots.
What we know
An account on X amplified security researcher another account on X's finding that eMudra-related intermediary certificates were issued with single-byte P-384 private keys — trivially exploitable to issue valid certs under them. The issue has seemingly gone undetected since 2025. Another account on X also highlighted that uv 0.13.4 has shipped with updated bundled certs in response, but notes this isn't unique to uv — the issue affects certifi, webpki-root-certs, and any project bundling CA certs. The call to action: upgrade everything that bundles CA certificates immediately.
By the Global Eye 24 desk, with AI assistance. Updated as the story develops. Spot an error? Write to corrections@globaleye24.com.