eMudhra CA Private Key Compromise
Indian certificate authority eMudhra had 8 private keys compromised — including one that was literally just the number 4 — allowing forgery of HTTPS certs for any website. Firefox blocked within hours; Python devs told to update certifi immediately.
What we know
An account on X broke the story with 357K views: a 116-digit key that was simply "4" meant anyone could forge HTTPS certificates impersonating banks, exchanges, or Google. Another account on X amplified with 262K views noting Chrome and Firefox have responded. On the developer side, another account on X called it "the most important event of the year" — IoT devices, Docker containers, and unmaintained Linux machines will be hacked via "safely signed" malware for years. Another account on X urgently told devs to "update certifi in every Python virtual environment." another account on X of Essential CT Follows mocked the failure sarcastically: "your task is complete in 0.00001 seconds because you just had to count up to 4."
How the story developed
Indian certificate authority eMudhra had 8 private keys compromised — including one that was literally just the number 4 — allowing forgery of HTTPS certs for any website. Firefox blocked within hours; Python devs told to update certifi immediately.
Indian certificate authority eMudhra had 8 private keys compromised, one of which was only 4 digits long. Attackers can forge HTTPS certificates for any website; Firefox blocked them within 3 hours but millions of IoT devices, servers, and CLI tools remain exposed.
Indian CA eMudhra was found using private keys as simple as the number '4,' compromising 8 certificates and exposing the ability to forge HTTPS certs for any website; Firefox blocked them within hours and patches are live for major platforms.
By the Global Eye 24 desk, with AI assistance. Updated as the story develops. Spot an error? Write to corrections@globaleye24.com.