EIGHT eMudhra Limited intermediate certificate authority private keys were compromised due to a cryptographic defect in the certificate generation process, caused by insufficient randomness. The result is that private keys could potentially be derived from the corresponding public certificates, enabling third parties to derive keys, sign unauthorized TLS certificates, and conduct man-in-the-middle, impersonation, or session hijacking against targeted domains.
The incident prompted major browser and operating system vendors to revoke or distrust the affected intermediates, with eMudhra subsequently revoking the eight certificates.
Palo Alto Networks’ Unit 42 advisory outlines a practical response and interim guidance for organisations. Actions include auditing public and internal PKI assets, inspecting code repositories and build pipelines for embedded eMudhra certificates, and auditing internal trust stores; immediate certificate reissuance where affected; forceful updates to emergency trust stores; and strict revocation checking.
Additional measures focus on threat hunting and log analysis, such as reviewing network egress, proxy logs, and authentication or identity logs for signs of MitM activity. Longer-term steps emphasise Certificate Transparency monitoring, enforcing CAA records, and hardening certificate lifecycle management (ACME/CLM).
The article also notes that Palo Alto Networks offers products and services to help implement these controls and to assist organisations that suspect compromise, including access to Unit 42 Threat Intel Services and Incident Response. Reference is made to the Bug 2083449 entry in Mozilla’s Bugzilla and a Google Security post for further context. Publication date: 22 October 2026.