[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fZLcgiV21lvn4m_muPCxvRIHYdBZeGsu7e43F72SnPfw":3},{"article":4,"iocs":50,"watch_terms":51,"solutions":52,"lesson":139},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":27,"category":28,"article_tags":32},"fcf71de4-5177-4d94-9b6c-e123131884c7","Disgraced former CA eMudhra blames buggy script for hopelessly weak certificates","disgraced-former-ca-emudhra-blames-buggy-script-for-hopelessly-weak-certificates-812f87","Couldn’t get the hardware it needed to generate certs, so tried to code a workaround","Certification authority eMudhra has stated a buggy Python script caused it to issue insecure digital certificates. The script truncated private key values, resulting in weak single-byte keys. eMudhra claims supply chain constraints prevented them from acquiring necessary hardware security modules, leading them to use a custom script as a workaround.","eMudhra blames buggy script for issuing weak certificates after supply chain issues.","https:\u002F\u002Fwww.theregister.com\u002Fsecurity\u002F2026\u002F11\u002F12\u002Fdisgraced-former-ca-emudhra-blames-buggy-script-for-hopelessly-weak-certificates\u002F5309244","https:\u002F\u002Fimage.theregister.com\u002F?imageId=229817&width=800","2026-11-12T04:22:18+00:00","2026-11-12T05:00:17.179077+00:00",7,[17,20,22,24],{"name":18,"type":19},"eMudhra","vendor",{"name":21,"type":19},"Utimaco",{"name":23,"type":19},"Crypto4A",{"name":25,"type":26},"emCA","product","80544778-fabb-4dcd-aa35-17492e5dcf4f",{"id":27,"icon":29,"name":30,"slug":31},null,"Vulnerabilities","vulnerabilities",[33,38,43,45],{"category":34},{"id":35,"icon":29,"name":36,"slug":37},"0493c7e9-989a-4692-b4e6-136f5ec09675","Cryptography","cryptography",{"category":39},{"id":40,"icon":29,"name":41,"slug":42},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":44},{"id":27,"icon":29,"name":30,"slug":31},{"category":46},{"id":47,"icon":29,"name":48,"slug":49},"c5c77cdb-f7d7-4990-9436-c81dcbff1163","Policy","policy",[],[18,21,23],{"controls":53,"vendors":138},[54,83,109],{"slug":55,"name":56,"problem":57,"products":58},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[59,67,75],{"vendor_slug":60,"vendor_name":61,"vendor_logo":62,"product_slug":63,"product_name":64,"url":65,"description":66},"rapid7","Rapid7","\u002Fvendor-logos\u002Frapid7.png","insightvm","Rapid7 Exposure Command (InsightVM)","https:\u002F\u002Fwww.rapid7.com\u002Fproducts\u002Finsightvm\u002F","Vulnerability scanning and risk-based prioritisation; InsightVM is now part of Exposure Command, alongside attack surface and cloud risk.",{"vendor_slug":68,"vendor_name":69,"vendor_logo":70,"product_slug":71,"product_name":72,"url":73,"description":74},"qualys","Qualys","\u002Fvendor-logos\u002Fqualys.png","vmdr","Qualys VMDR","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fvulnerability-management-detection-response\u002F","Vulnerability management, detection and response with risk-based prioritisation.",{"vendor_slug":76,"vendor_name":77,"vendor_logo":78,"product_slug":79,"product_name":80,"url":81,"description":82},"holm-security","Holm Security","\u002Fvendor-logos\u002Fholm-security.png","holm-security-platform","Holm Security Platform","https:\u002F\u002Fwww.holmsecurity.com\u002F","Vulnerability scanning of systems, web applications, cloud and the external attack surface, plus phishing simulation.",{"slug":84,"name":85,"problem":86,"products":87},"encryption-key-management","Encryption and key management","Stolen data stays unreadable, and the keys stay under your control.",[88,96,104],{"vendor_slug":89,"vendor_name":90,"vendor_logo":91,"product_slug":92,"product_name":93,"url":94,"description":95},"hashicorp","HashiCorp","\u002Fvendor-logos\u002Fhashicorp.png","vault","HashiCorp Vault","https:\u002F\u002Fwww.hashicorp.com\u002Fen\u002Fproducts\u002Fvault","Secrets management with short-lived credentials and encryption as a service.",{"vendor_slug":97,"vendor_name":98,"vendor_logo":99,"product_slug":100,"product_name":101,"url":102,"description":103},"thales","Thales","\u002Fvendor-logos\u002Fthales.png","ciphertrust","CipherTrust Data Security Platform","https:\u002F\u002Fcpl.thalesgroup.com\u002Fencryption\u002Fdata-security-platform","Data discovery, encryption and central key management across on-premises and cloud.",{"vendor_slug":97,"vendor_name":98,"vendor_logo":99,"product_slug":105,"product_name":106,"url":107,"description":108},"luna-hsm","Thales Luna HSM","https:\u002F\u002Fcpl.thalesgroup.com\u002Fencryption\u002Fhardware-security-modules","Hardware security modules for protecting cryptographic keys.",{"slug":110,"name":111,"problem":112,"products":113},"software-supply-chain","Software supply chain security","Malicious and vulnerable open-source packages are caught before they ship.",[114,122,130],{"vendor_slug":115,"vendor_name":116,"vendor_logo":117,"product_slug":118,"product_name":119,"url":120,"description":121},"snyk","Snyk","\u002Fvendor-logos\u002Fsnyk.png","snyk-open-source","Snyk Open Source","https:\u002F\u002Fsnyk.io\u002Fproduct\u002Fopen-source-security-management\u002F","Finds and fixes vulnerable open-source dependencies in code and pipelines.",{"vendor_slug":123,"vendor_name":124,"vendor_logo":125,"product_slug":126,"product_name":127,"url":128,"description":129},"sonatype","Sonatype","\u002Fvendor-logos\u002Fsonatype.png","sonatype-firewall","Sonatype Firewall","https:\u002F\u002Fwww.sonatype.com\u002Fproducts\u002Fsonatype-firewall","Blocks malicious and policy-violating open-source components at download.",{"vendor_slug":131,"vendor_name":132,"vendor_logo":133,"product_slug":134,"product_name":135,"url":136,"description":137},"github","GitHub","\u002Fvendor-logos\u002Fgithub.png","advanced-security","GitHub Advanced Security","https:\u002F\u002Fgithub.com\u002Fsecurity\u002Fadvanced-security","Dependency review, code scanning and secret scanning with push protection.",[],{"slug":140,"title":141,"body":142,"framework_refs":143,"framework_notes":149},"buggy-workaround-script-caused-emudhra-to-issue-cryptographically-weak-certificates","Buggy Workaround Script Caused eMudhra to Issue Cryptographically Weak Certificates","eMudhra, a trusted certificate authority, issued digital certificates with critically weak single-byte private keys because a custom Python script incorrectly truncated key values during generation. The root cause was a decision to substitute a homegrown script for a proper Hardware Security Module (HSM) — the gold-standard tooling required for certificate issuance — after claiming supply chain constraints made HSMs unavailable. This matters enormously because certificates issued by a CA form the backbone of public trust on the internet; weak keys can be trivially broken, undermining the security of every relying party. The incident demonstrates that operational workarounds in cryptographic pipelines must never bypass mandatory controls, and that supply chain constraints are not an acceptable justification for weakening fundamental security guarantees.",[144,145,146,147,148],"NIST SP 800-53 SC-12: Cryptographic Key Establishment and Management","NIST SP 800-53 SA-10: Developer Configuration Management","ISO\u002FIEC 27001:2022 A.8.24: Use of cryptography","NIS2 Article 21(2)(h)","NIS2 Article 21(2)(d)",{"NIS2 Article 21(2)(d)":150,"NIS2 Article 21(2)(h)":151,"ISO\u002FIEC 27001:2022 A.8.24: Use of cryptography":152,"NIST SP 800-53 SA-10: Developer Configuration Management":153,"NIST SP 800-53 SC-12: Cryptographic Key Establishment and Management":154},"NIS2's supply chain security point requires managing security risks in supplier relationships, and eMudhra's failure to maintain HSM availability through supplier diversification directly enabled the unsafe workaround.","NIS2's cryptography point requires entities to implement adequate policies on cryptography and encryption, which would have prohibited the use of an unvalidated script as a substitute for compliant cryptographic hardware.","This control requires the use of cryptography in accordance with established rules and standards, which eMudhra breached by substituting a non-compliant homegrown script for proper HSM-based key generation.","SA-10 requires that developers control and document changes to software and scripts used in security-relevant processes, which would have caught the truncation bug before the script was used in production.","SC-12 requires that cryptographic keys be generated, protected, and managed using approved mechanisms — using a buggy custom script instead of an HSM directly violates this control."]