8 Compromised TLS Certs Put Internet on High Alert
Original: The Internet goes on high alert after discovery of 8 compromised TLS certs
Why This Matters
Intermediate cert compromise enables broad credential forgery across the entire web.
Eight intermediate TLS certificates from India's eMudhra Limited were found to have fatally weak private keys on Oct. 20, 2026, allowing anyone to mint trusted credentials for any site. Browsers and major apps blocked all eight within hours.
Security teams worldwide scrambled Tuesday after eight intermediate TLS certificates issued by Indian certificate authority eMudhra Limited were found to have private keys weak enough to let any attacker forge trusted browser credentials for arbitrary sites. An informal advisory at emudhra.we-have-a-problem.com, signed 'We have a problem here – Wayne,' included a digital signature using one of the compromised private keys—proof that whoever found them had full control.
Browser makers, major apps, and some programming languages had blocked all eight certificates by late morning. Certificate transparency logs show no confirmed malicious use so far, but experts warn the cleanup will be long and painful. Cryptography engineer Filippo Valsorda, who also maintains Go's cryptography stack, called it 'a massive cleanup job, bigger than Heartbleed,' citing IoT devices, Docker containers, aging Linux machines, and tools that ship their own certificate roots—common in ecosystems like Python.
The Heartbleed comparison carries weight. That 2014 OpenSSL flaw triggered years of patching, certificate reissuance, and credential rotation across thousands of servers globally. This incident, Valsorda says, involves 'more contexts, more people, and more heterogeneity.' Linux distributions were still pushing updates as of Tuesday afternoon, with system administrators yet to apply them across fleets of machines.