MOZILLA blocked eight compromised eMudhra intermediate certificates after learning on 17 October 2026 that their private keys had been exposed. The certificates can be used to sign HTTPS certificates, so possession of their keys could allow an attacker to create trusted certificates for websites they do not control and, if able to intercept traffic, impersonate those sites or read or alter communications. The article says the keys were generated using tiny numbers that could be recovered by trying 256 values.
According to BleepingComputer, eMudhra blamed a script error that produced weak keys; the affected keys date back to April 2025. No fraudulent certificates have been confirmed.
Mozilla added the certificates to OneCRL, its revocation list, without requiring Firefox users to update or restart. The block reached users with standard settings by 22:59 UTC on 17 October. On 20 October, Mozilla released Firefox 158.0.1 for desktop and Android, and Firefox ESR 115.43.1 and 153.5.1, to protect users whose custom settings blocked OneCRL updates. NSS 3.131.1 also removes trust in three emSign roots, including the G3 root that signed the affected intermediates. Google Chrome blocked six of the certificates on 17 October, and Apple acted on 19 October.
The article also reports that Go released versions 1.27.3 and 1.26.10 to address the issue, tracked as CVE-2026-111943. Users should update Firefox, applications using NSS and Go-based tools; software with its own certificate store may need a separate update.