- Researchers cracked eight very weak secret keys tied to Indian certificate company eMudhra within seconds.
- Google, Apple, Microsoft and Mozilla now block the affected certificates, and Indian authorities have acknowledged the incident.
- Social media users argue over the failure, but claims of North Korean attacks remain unverified.
An Indian cybersecurity company has triggered a major internet security scare. Researchers found that eight secret keys tied to its digital certificates were very weak. They could recover these keys almost instantly.
The company, eMudhra, issues digital certificates. A digital certificate works like an online ID card for a website. These certificates help websites, software and connected systems earn trust from one another. Millions of people and groups depend on this trust every day. The incident has now raised serious worries about the safety of that system.
Researchers Crack Eight Secret Keys in Under One Second
Security researcher Scott Helme recovered several of the weak keys, according to reports. One key had the value 4. Other reported values were 56, 66, 115, 155, 156, 230 and 237. These numbers are extremely small. Strong secret keys should come from a powerful random generator instead.
A private key works like a secret house key. Only its owner should hold it. Anyone who gets a copy can act as the owner. That is why these keys must be very hard to guess.
Researchers worked out each secret key from its matching public information. The incident reportedly involves eight intermediate certificate authorities. Reports do not prove that every certificate eMudhra issued is compromised.
Digital certificates help browsers and other software confirm a website’s identity. They also help set up safe connections between users and online services. Certificate authorities play a key role in this process. Their certificates guide other systems on which services deserve trust.
Attackers who steal an authority’s private signing key could create fake certificates. They could then pose as real websites or services. Users could face phishing, message interception and other attacks. A fake certificate could make a bad website look real to some programs. The exact danger depends on how each program checks certificates.
The weakness was especially serious for one simple reason. Researchers recovered each secret number from the public information that matched it. That step took less than a second. Strong keys should resist this kind of quick recovery.
India Confirms the Flaw as Tech Giants Block Certificates
India’s Computer Emergency Response Team, known as CERT-In, confirmed the incident in an official advisory dated October 21, 2026. The agency explained that the affected keys belong to eMudhra’s international certificate business. That business operates under the global trust framework.
CERT-In also gave customers a clear note. eMudhra’s separate digital signature certificate and eSign services were not affected. India’s Controller of Certifying Authorities regulates those services. The advisory covers only the international business.
As per the reports, Google, Apple, Microsoft, and Mozilla have moved to block the affected certificates. Browsers use certificates to verify identity, so a block cuts off trust in the affected ones. India’s government has also ordered an investigation into the matter.
Separately, Amazon has announced plans to launch a secret-region cloud service to assist the CIA, highlighting the role major technology providers play in sensitive government operations.
Some online users linked the flaw to North Korean hackers. The available reporting does not support that claim. It also does not show that any state-backed group used the weakness in real attacks. Only the weak keys, the blocks and the official advisory are confirmed so far.
Social Media Users Argue Over the Security Failure
The news sparked heated reactions on X. Users questioned how such a basic cryptographic mistake could happen at a company trusted with internet safety. Many treated the weak keys as a failure of basic security work.
Several users posted sharp comments. Carrera (@yellow_primal) wrote that the incident made anti-Indian feelings seem fair. Memento mori T-Puppet (@twistedpuppet) mocked online claims about India’s skilled tech workers. DirtCat (@TheRealCat) criticised tech firms in India and blamed their hiring habits.
These posts show personal opinions only. They do not prove that Indian tech workers or companies are generally weak at their jobs.
Other users worried about sharing security flaws too early. GoreTiger (@GoreTiger64) asked whether the media should report such details before fixes arrive. StoolieJake (@StoolieJake) argued that the coverage could draw more attention to the weakness.
A third group of users focused on timing and accuracy. Spooks (@666spooked) claimed that someone had already patched the issue. The user also complained that social media reports often come late or carry hearsay. Major browser makers have acted, but the wider repair work may not be finished for every app or device.
The incident highlights several lessons. It shows why strong key creation, independent security reviews and fast certificate replacement matter. It also shows why people and groups should install trusted software updates. They should follow official advisories instead of viral posts. The confirmed problem is serious enough already. It needs no unverified claims about attackers or blame for a whole country’s tech workers.
Share this article
About the Author
Rebecca James is an IT consultant with forward thinking approach toward developing IT infrastructures of SMEs. She writes to engage with individuals and raise awareness of digital security, privacy, and better IT infrastructure.
More from Rebecca JamesRelated Posts
Microsoft Admits Windows 11 October Updates Failed to Fix Always On VPN Bug
Microsoft says its October 2026 Windows 11 updates did not fix the Always On VPN connection bug. The...
Canva Confirms Salesforce Data Exposure via Canny as Hackers Claim Millions of Records
Canva says hackers got into Canny, a tool it used for product feedback, and accessed some business c...
Phonelyne Faces Unverified Data Leak Claim Involving eSIM Codes and API Keys
A hacker called DaOnlySpark claims to hold customer, payment, and eSIM records tied to Phonelyne. Th...
BeyondTrust Remote Support Zero-Day Exploited by China-Linked Hackers
Google and Mandiant say a suspected China-linked group, Armory Castle, used the flaw before the publ...
GitHub Replaces Stargazer Scraping With Privacy-Focused Star History API
GitHub’s new API shows how a repository’s stars grow over time without revealing who sta...
US Flags China-Linked Hackers in Breach of Pacific Regional Organization
The U.S. Embassy says hackers linked to China infiltrated the systems of a regional group in Suva fo...
