Private keys corresponding to 8 eMudhra Intermediate certificates were compromised. The certificates include 6 for TLS use and 2 for code signing. These intermediates are trusted by Mozilla, Microsoft, Apple, and Chrome root programs, as well as downstream trust stores. The compromised certificates were revoked by eMudhra on October 18, 2026 and by Sectigo on October 19, 2026. The compromise poses a risk of certificate forgery and potential MITM attacks if clients do not reliably check revocation information.
Updated to confirm exploit availability and active exploitation based on test websites with working signatures; added actionable mitigation domains and browser removal actions by Chrome/Firefox.
