Threat Intelligence Brief
Curated summary with source attribution
Source: timesofindia.indiatimes.com
Threat Risk: Medium
Victim: Internet users and server administrators
Incident: Issuance of eight intermediate certificates with computationally trivial secret keys.
Impact: Potential for widespread website impersonation and unauthorized software signing.
Attacker: Unidentified threat actors
Analysis: eMudhra inadvertently issued eight intermediate certificates using critically weak secret keys that could be cracked in less than a second. This vulnerability stemmed from a failure in the randomness generation process during certificate creation in April 2025. While major browsers have revoked trust, the incident highlights a systemic failure in the CA’s issuance pipeline.
Recommendations: Update server-side trust stores and software lists manually; Verify active SSL/TLS certificates for any eMudhra-issued intermediates; Audit internal certificate issuance processes for entropy and randomness
Source: The Times of India
Editorial note: this post summarizes third-party reporting and links to the original source.
View Original Source