Keys left their hardware safeguard. eMudhra revokes eight more CA certificates.
Text
Key-handling failures widened the incident.
A company trusted to certify websites could not demonstrate safe handling of its own signing keys. eMudhra's November 10 report confirms eight more RSA intermediate certificates were revoked on November 7 after keys passed through Python memory, bringing the total to 16.
Certificates help browsers verify identities. An intermediate CA's signing key resembles a seal that can vouch for many websites, which is why such keys normally receive specialized hardware protection.
An earlier signature mismatch was fixed without tracing its cause, the report acknowledges. Fixing a symptom and auditing the entire key-handling process are different jobs.
The RSA keys were not truncated, and eMudhra reports no known misuse. Memory handling does not establish theft. Keep browsers and operating systems updated, and do not click past certificate warnings.
Source times: eMudhra, Beijing 2026-11-11 02:35:42 / EST 2026-11-10 13:35:42; BleepingComputer, Beijing 2026-11-12 05:27:40 / EST 2026-11-11 16:27:40.
Share this article
What do you think of this story?
Anonymous feedback, up to 5 reactions per article.
Anonymous comments
Share your thoughts without signing in.
Discuss the technology and the story. Hate, politics and war, threats, abuse, personal accusations, sexual content, ads, links and personal information are not allowed.
No comments yet. Be the first to share.