SecurityOnlineDo Son
Apple Blocks Compromised eMudhra Certificates Across Its Devices
Part of the eMudhra story · since 20 Oct
- Tue 20 Oct, 12:31 UTC. The Hacker News, first report. Go Blocks Eight eMudhra Certificate Keys in Emergency Update.
- Tue 20 Oct, 18:35 UTC. The Hacker News. Browsers Block Eight Compromised eMudhra Certificate Authority Keys.
- Tue 20 Oct, 20:21 UTC. Ars Technica, its first report on the story. Browsers block eight eMudhra certificates after weak keys risk trusted forgeries.
- Tue 20 Oct, 22:30 UTC. Dark Reading, its first report on the story. Tech Giants Block Eight eMudhra Keys After Compromise Exposed.
- Tue 20 Oct, 22:31 UTC. Cloudflare, its first report on the story. Cloudflare Warns Compromised Certificate Keys Could Enable Server Impersonation.
- Wed 21 Oct, 02:31 UTC. SANS ISC, its first report on the story. eMudhra Revokes Eight CAs After Private Keys Were Created One Byte Long.
- Wed 21 Oct, 03:01 UTC. SecurityOnline, its first report on the story. Mozilla Blocks Weak eMudhra Keys That Could Enable Website Impersonation.
- Wed 21 Oct, 11:38 UTC. SecurityWeek, its first report on the story. Weak eMudhra keys let attackers forge trusted HTTPS certificates.
- Wed 21 Oct, 14:46 UTC. SOCRadar, its first report on the story. Weak eMudhra CA Keys Let Attackers Forge Trusted TLS Certificates.
- Thu 22 Oct, 17:48 UTC. Unit 42, its first report on the story. Weak randomness exposes eMudhra certificate keys, enabling TLS attacks.
- Thu 22 Oct, 18:23 UTC. The Hacker News. eMudhra Exits SSL Business After Private Keys Are Recovered.
- Thu 22 Oct, 20:12 UTC. StepSecurity, its first report on the story. Python Urges Users to Update Tools After CA Key Compromise Threat.
- Thu 22 Oct, 20:48 UTC. Ars Technica. eMudhra Exits Global TLS Market After Eight Weak Keys Were Issued.
- Fri 23 Oct, 04:30 UTC. SecurityOnline. Oracle Rushes Fix for Compromised Certificates Threatening Java Users.
- Mon 26 Oct, 03:19 UTC. SecurityOnline. eMudhra faces backlash over delayed certificate disclosures.
- Mon 26 Oct, 07:30 UTC. SecurityOnline. Weak eMudhra Keys Enable Thousands of Rogue Certificates.
- Tue 27 Oct, 02:01 UTC. SecurityOnline. Apple Blocks Compromised eMudhra Certificates Across Its Devices. This article, 17th of 17.
Apple has moved to shield macOS and iOS users from compromised Indian certificate authority eMudhra by automatically blacklisting eight compromised intermediate certificates. The update also targets the primary emSign ECC Root CA – G3 anchor for distrust. Apple says Safari and Mail received dynamic protections via silent security configuration pushes, while standalone command‑line utilities will require further OS patches to be fully neutralised.
The flaw centres on eight eMudhra intermediate private keys, six used for TLS certificates and two for code signing. Because each TLS intermediate has dual issuance chains—one from emSign roots and another cross‑signed by Sectigo AAA Certificate Services—the resulting blacklisting spans twelve distinct intermediate profiles. Apple began transmitting automated security assets to client hardware on 19 October 2026, enabling end users to benefit without rebooting.
On 23 October 2026 engineers began blocking the emSign ECC Root CA – G3 anchor. Google Chrome and Mozilla Firefox are pursuing similar root distrust actions. However, local command‑line binaries such as curl, git, python3 and openssl may still trust tainted chains unless real‑time online revocation checks are enforced, since they rely on the static /etc/ssl/cert[.]pem trust store.
How the story developed
17 articles from 10 outlets since 20 Oct. Picked up again on 26 Oct after 3 days quiet. This was the 17th report, 7 days after the first.
- Tue 20 Oct, 12:31 UTC. The Hacker News, first report. Go Blocks Eight eMudhra Certificate Keys in Emergency Update.
- Tue 20 Oct, 18:35 UTC. The Hacker News. Browsers Block Eight Compromised eMudhra Certificate Authority Keys.
- Tue 20 Oct, 20:21 UTC. Ars Technica, its first report on the story. Browsers block eight eMudhra certificates after weak keys risk trusted forgeries.
- Tue 20 Oct, 22:30 UTC. Dark Reading, its first report on the story. Tech Giants Block Eight eMudhra Keys After Compromise Exposed.
- Tue 20 Oct, 22:31 UTC. Cloudflare, its first report on the story. Cloudflare Warns Compromised Certificate Keys Could Enable Server Impersonation.
- Wed 21 Oct, 02:31 UTC. SANS ISC, its first report on the story. eMudhra Revokes Eight CAs After Private Keys Were Created One Byte Long.
- Wed 21 Oct, 03:01 UTC. SecurityOnline, its first report on the story. Mozilla Blocks Weak eMudhra Keys That Could Enable Website Impersonation.
- Wed 21 Oct, 11:38 UTC. SecurityWeek, its first report on the story. Weak eMudhra keys let attackers forge trusted HTTPS certificates.
- Wed 21 Oct, 14:46 UTC. SOCRadar, its first report on the story. Weak eMudhra CA Keys Let Attackers Forge Trusted TLS Certificates.
- Thu 22 Oct, 17:48 UTC. Unit 42, its first report on the story. Weak randomness exposes eMudhra certificate keys, enabling TLS attacks.
- Thu 22 Oct, 18:23 UTC. The Hacker News. eMudhra Exits SSL Business After Private Keys Are Recovered.
- Thu 22 Oct, 20:12 UTC. StepSecurity, its first report on the story. Python Urges Users to Update Tools After CA Key Compromise Threat.
- Thu 22 Oct, 20:48 UTC. Ars Technica. eMudhra Exits Global TLS Market After Eight Weak Keys Were Issued.
- Fri 23 Oct, 04:30 UTC. SecurityOnline. Oracle Rushes Fix for Compromised Certificates Threatening Java Users.
- Mon 26 Oct, 03:19 UTC. SecurityOnline. eMudhra faces backlash over delayed certificate disclosures.
- Mon 26 Oct, 07:30 UTC. SecurityOnline. Weak eMudhra Keys Enable Thousands of Rogue Certificates.
- Tue 27 Oct, 02:01 UTC. SecurityOnline. Apple Blocks Compromised eMudhra Certificates Across Its Devices. This article, 17th of 17.
- CVE not in KEV
- No CVE
- Larger: an outlet’s first report
- Coverage over time
- Quiet time, folded
Show all 17 articles as a listHide the list
- Tue 20 OctDay 05
- Go Blocks Eight eMudhra Certificate Keys in Emergency Update12:31 · The Hacker News · First report
- Browsers Block Eight Compromised eMudhra Certificate Authority Keys18:35 · The Hacker News
- Browsers block eight eMudhra certificates after weak keys risk trusted forgeries20:21 · Ars Technica
Show 2 more from 20 Oct
- Tech Giants Block Eight eMudhra Keys After Compromise Exposed22:30 · Dark Reading
- Wed 21 OctDay 14
- Mozilla Blocks Weak eMudhra Keys That Could Enable Website Impersonation03:01 · SecurityOnline
- Weak eMudhra keys let attackers forge trusted HTTPS certificates11:38 · SecurityWeek
- Thu 22 OctDay 24
- eMudhra Exits SSL Business After Private Keys Are Recovered18:23 · The Hacker News
- Python Urges Users to Update Tools After CA Key Compromise Threat20:12 · StepSecurity
- eMudhra Exits Global TLS Market After Eight Weak Keys Were Issued20:48 · Ars Technica
- Fri 23 OctDay 31
- Oracle Rushes Fix for Compromised Certificates Threatening Java Users04:30 · SecurityOnline
Quiet for 3 days
Mon 26 OctDay 62- eMudhra faces backlash over delayed certificate disclosures03:19 · SecurityOnline · Picked up again
- Weak eMudhra Keys Enable Thousands of Rogue Certificates07:30 · SecurityOnline
- Tue 27 OctDay 71
- Apple Blocks Compromised eMudhra Certificates Across Its Devices02:01 · SecurityOnline · This article, 17th of 17