[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fENRUSLGJ6PTzZ13ROlnLWFaqGtk_Q5pLw1_ByJCTc_o":3},{"article":4,"iocs":50,"watch_terms":51,"solutions":52,"lesson":139},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":27,"category":28,"article_tags":32},"847d137c-086c-4537-83ec-c549d79010bd","eMudhra revokes 8 more CA certificates after private key mishap","emudhra-revokes-8-more-ca-certificates-after-private-key-mishap-c13c66","Certificate authority eMudhra has revoked eight additional intermediate CA certificates after an investigation into its recent certificate security incident found improper handling of private keys during the certificate-generation process. [...]","Certificate authority eMudhra has revoked eight additional intermediate CA certificates, bringing the total to 16, due to improper handling of private keys during certificate generation. A custom Python script used to transfer keys between HSMs contained a bug that weakened ECDSA private keys and mishandled RSA private keys. The company could not demonstrate that the RSA keys met its security policies, leading to their revocation. An earlier incident in June 2025, where CRLs were signed with mismatched keys, was identified as an early warning sign of this faulty process.","eMudhra revokes 8 more CA certificates due to improper private key handling.","https:\u002F\u002Fwww.bleepingcomputer.com\u002Fnews\u002Fsecurity\u002Femudhra-revokes-8-more-ca-certificates-after-private-key-mishap\u002F","https:\u002F\u002Fwww.bleepstatic.com\u002Fcontent\u002Fhl-images\u002F2026\u002F10\u002F20\u002Fcertificate.jpg","2026-11-11T21:27:40+00:00","2026-11-11T22:00:22.456381+00:00",8,[17,20,23,25],{"name":18,"type":19},"eMudhra","vendor",{"name":21,"type":22},"HSM","technology",{"name":24,"type":22},"ECDSA",{"name":26,"type":22},"RSA","80544778-fabb-4dcd-aa35-17492e5dcf4f",{"id":27,"icon":29,"name":30,"slug":31},null,"Vulnerabilities","vulnerabilities",[33,38,43,45],{"category":34},{"id":35,"icon":29,"name":36,"slug":37},"0493c7e9-989a-4692-b4e6-136f5ec09675","Cryptography","cryptography",{"category":39},{"id":40,"icon":29,"name":41,"slug":42},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":44},{"id":27,"icon":29,"name":30,"slug":31},{"category":46},{"id":47,"icon":29,"name":48,"slug":49},"c5eccf7c-abbc-4bd3-bbed-e6da5cba8e73","Incident Response","incident-response",[],[18],{"controls":53,"vendors":138},[54,83,112],{"slug":55,"name":56,"problem":57,"products":58},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[59,67,75],{"vendor_slug":60,"vendor_name":61,"vendor_logo":62,"product_slug":63,"product_name":64,"url":65,"description":66},"axonius","Axonius","\u002Fvendor-logos\u002Faxonius.png","axonius-exposures","Axonius Exposures","https:\u002F\u002Fwww.axonius.com\u002Fplatform\u002Fexposures","Brings findings from different scanners together with asset and business context, to show what matters most and track fixes to the end.",{"vendor_slug":68,"vendor_name":69,"vendor_logo":70,"product_slug":71,"product_name":72,"url":73,"description":74},"holm-security","Holm Security","\u002Fvendor-logos\u002Fholm-security.png","holm-security-platform","Holm Security Platform","https:\u002F\u002Fwww.holmsecurity.com\u002F","Vulnerability scanning of systems, web applications, cloud and the external attack surface, plus phishing simulation.",{"vendor_slug":76,"vendor_name":77,"vendor_logo":78,"product_slug":79,"product_name":80,"url":81,"description":82},"qualys","Qualys","\u002Fvendor-logos\u002Fqualys.png","vmdr","Qualys VMDR","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fvulnerability-management-detection-response\u002F","Vulnerability management, detection and response with risk-based prioritisation.",{"slug":84,"name":85,"problem":86,"products":87},"security-monitoring-siem","Security monitoring (SIEM)","Logs from everywhere end up in one place, with alerts that someone actually sees.",[88,96,104],{"vendor_slug":89,"vendor_name":90,"vendor_logo":91,"product_slug":92,"product_name":93,"url":94,"description":95},"vega","Vega","\u002Fvendor-logos\u002Fvega.png","vega-agentic-detection","Agentic Detection","https:\u002F\u002Fvega.io\u002Fplatform\u002Fagentic-detection","Detection rules that run across security data in the stores where it already lives, so logs do not have to be moved into a central SIEM first.",{"vendor_slug":97,"vendor_name":98,"vendor_logo":99,"product_slug":100,"product_name":101,"url":102,"description":103},"guardsix","Guardsix","\u002Fvendor-logos\u002Fguardsix.png","guardsix-siem","Guardsix SIEM","https:\u002F\u002Fguardsix.com\u002Fproduct\u002Fsiem","SIEM with automation, developed and hosted in Europe.",{"vendor_slug":105,"vendor_name":106,"vendor_logo":107,"product_slug":108,"product_name":109,"url":110,"description":111},"google","Google","\u002Fvendor-logos\u002Fgoogle.png","google-security-operations","Google Security Operations","https:\u002F\u002Fcloud.google.com\u002Fsecurity\u002Fproducts\u002Fsecurity-operations","Cloud SIEM and SOAR, formerly Chronicle.",{"slug":113,"name":114,"problem":115,"products":116},"encryption-key-management","Encryption and key management","Stolen data stays unreadable, and the keys stay under your control.",[117,125,133],{"vendor_slug":118,"vendor_name":119,"vendor_logo":120,"product_slug":121,"product_name":122,"url":123,"description":124},"thales","Thales","\u002Fvendor-logos\u002Fthales.png","ciphertrust","CipherTrust Data Security Platform","https:\u002F\u002Fcpl.thalesgroup.com\u002Fencryption\u002Fdata-security-platform","Data discovery, encryption and central key management across on-premises and cloud.",{"vendor_slug":126,"vendor_name":127,"vendor_logo":128,"product_slug":129,"product_name":130,"url":131,"description":132},"utimaco","Utimaco","\u002Fvendor-logos\u002Futimaco.png","utimaco-hsm","Utimaco General Purpose HSM","https:\u002F\u002Futimaco.com\u002Fdata-protection\u002Fgp-hsm","Hardware security modules for key generation, storage and cryptographic operations.",{"vendor_slug":118,"vendor_name":119,"vendor_logo":120,"product_slug":134,"product_name":135,"url":136,"description":137},"luna-hsm","Thales Luna HSM","https:\u002F\u002Fcpl.thalesgroup.com\u002Fencryption\u002Fhardware-security-modules","Hardware security modules for protecting cryptographic keys.",[],{"slug":140,"title":141,"body":142,"framework_refs":143,"framework_notes":149},"buggy-key-migration-script-compromises-16-emudhra-ca-certificates","Buggy Key Migration Script Compromises 16 eMudhra CA Certificates","eMudhra's use of a custom Python script to transfer private keys between Hardware Security Modules (HSMs) introduced a critical bug that weakened ECDSA keys and mishandled RSA keys, ultimately undermining the cryptographic integrity of 16 intermediate CA certificates. The root cause was inadequate validation and testing of the key migration tooling before it was used in production on highly sensitive cryptographic material. A missed early warning — CRLs signed with mismatched keys in June 2025 — shows that existing monitoring failed to flag a serious process failure in time. This incident matters because compromised CA private keys can enable the issuance of fraudulent certificates, eroding trust across the entire PKI ecosystem that relies on eMudhra as a trusted authority.",[144,145,146,147,148],"NIST SP 800-53 SC-12: Cryptographic Key Establishment and Management","NIST SP 800-53 SA-11: Developer Testing and Evaluation","ISO\u002FIEC 27001:2022 A.8.24: Use of cryptography","NIS2 Article 21(2)(h)","NIST CSF 2.0 DE.CM-03: Personnel activity and technology usage are monitored to find potentially adverse events",{"NIS2 Article 21(2)(h)":150,"ISO\u002FIEC 27001:2022 A.8.24: Use of cryptography":151,"NIST SP 800-53 SA-11: Developer Testing and Evaluation":152,"NIST SP 800-53 SC-12: Cryptographic Key Establishment and Management":153,"NIST CSF 2.0 DE.CM-03: Personnel activity and technology usage are monitored to find potentially adverse events":154},"NIS2 Article 21(2)(h) explicitly covers policies on cryptography and encryption, which the flawed key migration process violated by failing to maintain the integrity of CA private keys.","A.8.24 requires a policy on cryptographic key management and proper use of cryptography; the absence of enforced controls over the key transfer process directly caused the private key mishandling.","SA-11 requires that custom-developed code undergo security testing before deployment; the Python HSM migration script was not adequately tested, allowing a key-weakening bug to reach production.","SC-12 requires organizations to establish and manage cryptographic keys according to documented policies; the buggy migration script violated key management integrity requirements that this control mandates.","Continuous monitoring of PKI operational outputs — such as CRL signing key consistency — would have elevated the June 2025 mismatch to an actionable alert rather than a missed warning sign."]