4 real? Tracking exploitation and patching of eMudhra’s weak keys

Cloudflare reported that eMudhra issued eight critically weak intermediate certificate authority keys, including values as small as 4, allowing anyone to derive the private signing keys from public certificates and potentially forge certificates trusted by unpatched clients that do not enforce Certificate Transparency. Cloudflare rapidly updated its high-priority systems, including its Pingora outbound TLS proxies, and found roughly 22,000 attempted TLS handshakes involving the compromised keys, most linked to testing or self-generated certificates; while some forged certificates appeared shortly after disclosure, Cloudflare found no evidence of successful interception of its connections. Using browser challenge-page probes, the company estimated that current mainstream browsers were largely patched, but many bots, older browsers, embedded browsers such as Android WebView, and clients across major networks continued accepting compromised certificate chains, with patching progress slowing after an initial period. eMudhra said it would leave the public CA business and attributed the incident to a key-generation script error, though Cloudflare noted unresolved questions about the failure, auditing, and cross-signing processes. Cloudflare urged organizations and developers to patch affected software and advocated for faster, more flexible trust-store revocation mechanisms to address similar security failures.

No tracked trend matches for this post yet.

Use this post, company, and trend context to find content marketing opportunities, perform competitive analysis, or address product feature gaps via the Plushcap MCP server or the Plushcap API.