[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fQisQpaUU7LWtvuM286vVNlx0ABSnLlR-2_SCLl3ZKL0":3},{"article":4,"iocs":46,"watch_terms":51,"solutions":52,"lesson":144},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":28,"category":29,"article_tags":33},"5566be7c-b3ec-44ed-8500-1cf6acade046","Mozilla, Google, Apple block compromised eMudhra CA certificates","mozilla-google-apple-block-compromised-emudhra-ca-certificates-c75006","Certificate authority eMudhra revoked eight compromised intermediate certificates after researchers found their private keys were so weak that anyone could recover them almost instantly and use them to forge trusted certificates for legitimate websites. [...]","Certificate authority eMudhra revoked eight intermediate certificates after researchers discovered their private keys were extremely weak, allowing for instant recovery and potential forging of trusted certificates. Major browsers and operating systems have since blocked these compromised certificates to prevent attackers from impersonating legitimate websites and intercepting communications.","Mozilla, Google, Apple block compromised eMudhra CA certificates due to weak private keys.","https:\u002F\u002Fwww.bleepingcomputer.com\u002Fnews\u002Fsecurity\u002Fmozilla-google-apple-block-compromised-emudhra-ca-certificates\u002F","https:\u002F\u002Fwww.bleepstatic.com\u002Fcontent\u002Fhl-images\u002F2026\u002F10\u002F20\u002Fcertificate.jpg","2026-10-21T00:46:42+00:00","2026-10-21T02:00:04.679114+00:00",8,[17,20,22,24,26],{"name":18,"type":19},"Mozilla","vendor",{"name":21,"type":19},"Google",{"name":23,"type":19},"Apple",{"name":25,"type":19},"eMudhra",{"name":27,"type":19},"Sectigo","80544778-fabb-4dcd-aa35-17492e5dcf4f",{"id":28,"icon":30,"name":31,"slug":32},null,"Vulnerabilities","vulnerabilities",[34,39,41],{"category":35},{"id":36,"icon":30,"name":37,"slug":38},"0493c7e9-989a-4692-b4e6-136f5ec09675","Cryptography","cryptography",{"category":40},{"id":28,"icon":30,"name":31,"slug":32},{"category":42},{"id":43,"icon":30,"name":44,"slug":45},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[47],{"type":48,"value":49,"context":50},"cve","CVE-2026-111943","Identifier for the Go development team's patch",[21,23,18],{"controls":53,"vendors":136},[54,83,110],{"slug":55,"name":56,"problem":57,"products":58},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[59,67,75],{"vendor_slug":60,"vendor_name":61,"vendor_logo":62,"product_slug":63,"product_name":64,"url":65,"description":66},"tenable","Tenable","\u002Fvendor-logos\u002Ftenable.png","tenable-vulnerability-management","Tenable Vulnerability Management","https:\u002F\u002Fwww.tenable.com\u002Fproducts\u002Fvulnerability-management","Cloud-based vulnerability scanning and prioritisation, built on Nessus.",{"vendor_slug":68,"vendor_name":69,"vendor_logo":70,"product_slug":71,"product_name":72,"url":73,"description":74},"rapid7","Rapid7","\u002Fvendor-logos\u002Frapid7.png","insightvm","Rapid7 Exposure Command (InsightVM)","https:\u002F\u002Fwww.rapid7.com\u002Fproducts\u002Finsightvm\u002F","Vulnerability scanning and risk-based prioritisation; InsightVM is now part of Exposure Command, alongside attack surface and cloud risk.",{"vendor_slug":76,"vendor_name":77,"vendor_logo":78,"product_slug":79,"product_name":80,"url":81,"description":82},"axonius","Axonius","\u002Fvendor-logos\u002Faxonius.png","axonius-exposures","Axonius Exposures","https:\u002F\u002Fwww.axonius.com\u002Fplatform\u002Fexposures","Brings findings from different scanners together with asset and business context, to show what matters most and track fixes to the end.",{"slug":45,"name":84,"problem":85,"products":86},"Threat intelligence","Attack campaigns reach your sector, suppliers or software before your team hears about them.",[87,95,103],{"vendor_slug":88,"vendor_name":89,"vendor_logo":90,"product_slug":91,"product_name":92,"url":93,"description":94},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-adversary-intelligence","Falcon Adversary Intelligence","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fthreat-intelligence\u002F","Threat intelligence on the adversaries CrowdStrike tracks, built into the Falcon platform to detect, disrupt and defend against them.",{"vendor_slug":96,"vendor_name":97,"vendor_logo":98,"product_slug":99,"product_name":100,"url":101,"description":102},"defused","Defused","\u002Fvendor-logos\u002Fdefused.png","defused-tf","Defused TF","https:\u002F\u002Fdefusedcyber.com\u002Fproduct\u002Ftf","Threat intelligence feed from honeypots Defused runs on several continents, showing which vulnerabilities attackers are exploiting right now, with payloads and indicators.",{"vendor_slug":104,"vendor_name":21,"vendor_logo":105,"product_slug":106,"product_name":107,"url":108,"description":109},"google","\u002Fvendor-logos\u002Fgoogle.png","google-threat-intelligence","Google Threat Intelligence","https:\u002F\u002Fcloud.google.com\u002Fsecurity\u002Fproducts\u002Fthreat-intelligence","Threat intelligence from Mandiant's frontline investigations, Google's threat analysts, open sources and Google's own visibility, in one service.",{"slug":111,"name":112,"problem":113,"products":114},"encryption-key-management","Encryption and key management","Stolen data stays unreadable, and the keys stay under your control.",[115,123,131],{"vendor_slug":116,"vendor_name":117,"vendor_logo":118,"product_slug":119,"product_name":120,"url":121,"description":122},"thales","Thales","\u002Fvendor-logos\u002Fthales.png","ciphertrust","CipherTrust Data Security Platform","https:\u002F\u002Fcpl.thalesgroup.com\u002Fencryption\u002Fdata-security-platform","Data discovery, encryption and central key management across on-premises and cloud.",{"vendor_slug":124,"vendor_name":125,"vendor_logo":126,"product_slug":127,"product_name":128,"url":129,"description":130},"utimaco","Utimaco","\u002Fvendor-logos\u002Futimaco.png","utimaco-hsm","Utimaco General Purpose HSM","https:\u002F\u002Futimaco.com\u002Fdata-protection\u002Fgp-hsm","Hardware security modules for key generation, storage and cryptographic operations.",{"vendor_slug":116,"vendor_name":117,"vendor_logo":118,"product_slug":132,"product_name":133,"url":134,"description":135},"luna-hsm","Thales Luna HSM","https:\u002F\u002Fcpl.thalesgroup.com\u002Fencryption\u002Fhardware-security-modules","Hardware security modules for protecting cryptographic keys.",[137,142],{"slug":138,"name":23,"logo_path":139,"roles":140},"apple","\u002Fvendor-logos\u002Fapple.png",[141],"reported_by",{"slug":104,"name":21,"logo_path":105,"roles":143},[141],{"slug":145,"title":146,"body":147,"framework_refs":148,"framework_notes":156},"weak-ca-private-keys-enable-certificate-forgery-across-major-browsers","Weak CA Private Keys Enable Certificate Forgery Across Major Browsers","eMudhra, a trusted Certificate Authority, generated eight intermediate certificates using cryptographically weak private keys that could be instantly recovered by attackers. This failure in cryptographic key generation allowed for the potential forging of trusted certificates, meaning attackers could impersonate any website secured by those certificates and intercept encrypted communications. The incident highlights a critical trust dependency in the PKI (Public Key Infrastructure) supply chain — when a CA fails to meet cryptographic standards, every website relying on its certificates becomes a potential attack vector. Major browsers and operating systems were forced into reactive emergency blocklisting, underscoring the systemic risk that poor CA security hygiene poses to the entire internet ecosystem.",[149,150,151,152,153,154,155],"CIS Control 7: Continuous Vulnerability Management","NIST SP 800-53 SI-2: Flaw Remediation","ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities","NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control","GDPR Article 32","NIS2 Article 21(2)(b)","CIS Control 17: Incident Response Management",{"GDPR Article 32":157,"NIS2 Article 21(2)(b)":158,"NIST SP 800-53 SI-2: Flaw Remediation":159,"CIS Control 17: Incident Response Management":160,"CIS Control 7: Continuous Vulnerability Management":161,"ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities":162,"NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control":163},"GDPR requires appropriate technical measures to ensure data confidentiality and integrity; compromised CA certificates that enable traffic interception directly violate this obligation for any EU data subjects affected.","NIS2 mandates incident handling and supply chain security measures; this incident illustrates a supply chain trust failure where a CA's poor security practices created systemic risk for all relying parties.","SI-2 requires organizations to identify and correct information system flaws; a formal process for reviewing CA cryptographic hygiene would have flagged substandard key generation as a remediable flaw.","The reactive nature of browser and OS blocklisting after external researcher discovery indicates that eMudhra lacked a proactive incident response and self-detection capability for cryptographic failures within its own infrastructure.","Regular cryptographic strength assessments of issued certificates would have identified the weak private keys before researchers discovered them externally, enabling proactive remediation.","This control requires timely identification and remediation of technical vulnerabilities, which directly applies to the failure to detect and correct cryptographically weak key generation practices within the CA.","Trusted certificate issuance is a cornerstone of authentication on the internet; weak CA keys undermine the integrity of identity assurance that this control seeks to protect."]