Eight Compromised TLS Certificates Threaten Global Internet Security

Security teams worldwide reacted after discovering eight TLS certificates issued by India‑based eMudhra Limited whose private keys are weak enough to allow anyone to forge trusted browser and app credentials. Browser vendors and major software ecosystems have already blocked the eight intermediate certificates, and no evidence of malicious use appears in certificate‑transparency logs. However, the danger persists because updating other critical components—such as Linux distributions, embedded systems, and IoT devices—will be slow and labor‑intensive. The breach was first revealed when an informal advisory posted to emudhra. we-have-a-problem. com contained a message signed with one of the compromised keys, proving the attacker’s control. The incident underscores the fragility of the trust chain that underpins the modern web.