Researchers Crack Eight Weak Keys From India’s eMudhra in Under a Second

Researchers have found a serious flaw in the security setup of Indian certificate provider eMudhra. Eight private keys, tied to the company’s intermediate certificate authorities, were dangerously weak. Experts recovered them almost instantly. Reports say one key was simply the number four.

Major technology companies moved to block the affected certificates. Even so, security experts warn that some apps, connected devices and software packages may stay at risk. They will remain exposed until their certificate lists receive the needed updates.

Researcher Recovers Eight eMudhra Keys in Under a Second

According to Google’s Chrome Security Team, a researcher reported the weak keys on October 17, 2026. eMudhra created the affected certificates in April 2025. Six of them protect secure web connections, known as HTTPS. The other two handle code signing, which shows who made a piece of software.

Security researcher Scott Helme recovered all eight private keys on his own. He needed less than one second. One key was the number four. The others were 56, 66, 115, 155, 156, 230 and 237. Safe keys need far larger and more random numbers than these tiny values. Helme explained the recovery in a detailed write-up.

Certificate authorities help browsers and apps check that websites and software makers are real. An intermediate authority uses a private key to vouch for others. An attacker who holds that key could make fake certificates. A fake website could then look trustworthy to systems that still accept those certificates.

Google, Mozilla, Apple and Microsoft Block the Certificates

Google confirmed that Chrome now blocks the six authorities used for TLS connections. Mozilla blocked the certificates in Firefox, as its public bug report shows. Apple and Microsoft also took protective action. eMudhra revoked the affected certificates. The company then began working with browser makers and other industry groups.

Some social media posts described the case as a huge threat to most of the web. Investigators have not confirmed that claim. In its official statement, eMudhra said the flaw touched eight intermediate authorities in its global TLS business. The company said most of them never went into live use. Its review found no sign that they issued certificates for everyday websites.

Google reported a similar result. Its Certificate Transparency checks found no TLS certificates under the six authorities before the block. That lowers the risk for clients that enforce those checks. Chrome uses this protection by default for publicly trusted certificates.

The available evidence does not show that attackers used these keys to harm internet users. Still, a missing record of fake certificates does not prove every attack failed. Anyone could have recovered the weak keys from public certificate details since 2025.

Experts Urge Updates as Older Software Stays Exposed

Trouble remains for programs that use their own certificate lists. Some programs also fail to check reliably whether a certificate was revoked. These programs may keep trusting the affected authorities. They will do so until developers release fixes and users or administrators install them. Command-line tools, software libraries, automated build systems and connected devices may all be affected.

Users should install every available browser, operating system and app update. Blocking the certificates in major browsers does not protect every program on a device. Reports say people should not assume that one fix covers all their software.

Developers and IT administrators should read the official security notices. They should update their certificate bundles and check whether their software relies on the affected authorities. Organisations that use eMudhra certificates should also check whether their certificates link back to the affected root. They should arrange replacements where needed.

The incident also sparked angry reactions on social media. Some people called for cutting business ties with India. Others asked for stricter immigration and employment checks. Those political arguments are separate from the technical evidence. They do not explain why the security failure happened.

Separately, a hacker group allegedly threatened to leak the passports and birth certificates of 120 Israelis, highlighting the risks criminals pose to sensitive identity documents.

According to the reports, the main lesson is simple. Internet security depends on good key creation, strict controls, and timely updates. One weak key can damage trust in systems that millions of people use. The underlying encryption technology itself remains strong.