Tech giants rush to block 8 eMudhra certs that could enable fake sites
Summary
Major technology companies blocked eight intermediate certificates issued by India-based certificate authority eMudhra after researchers found their private keys were generated insecurely and could be recovered. Attackers could use fraudulent certificates to impersonate websites and intercept or alter communications. Mozilla, Chrome, Apple and Microsoft platforms deployed blocks, while Mozilla and Cloudflare also issued updates. There is no evidence the certificates were used to attack major browsers, and certificate transparency logs showed no activity since April 2025. However, some non-browser applications may not receive automatic protections, and it is unknown whether they were targeted.
