eMudhra, an Indian certificate authority, has had 8 private security keys compromised with half the internet is cooked The keys were incredibly weak. One of them was literally just “4” The keys could have been used to create fake HTTPS certificates and make malicious websites appear legitimate. Chrome, Firefox, Apple and Microsoft have blocked the affected certificates. Older devices, software and apps may still need updates.

Following the discovery that eight eMudhra intermediate certificates use weak keys, Cloudflare is deploying mitigations and releasing client updates. We explain the impact, our response, and what customers and developers should do next.

Last week is the new normal. Wednesday to Sunday: eMudhra certs, PHP2Shell, Railway, Node2Shell/Brotli, Tailworm, and probably a couple more I've already forgotten. This is the AI vulnerability wave everyone was bracing for. These should have been non-events. If a service isn't exposed to the internet and you're patching weekly, you read the advisory and move on, confident that the service will be patched. So this is our first serious fire drill of AI vulnerabilities. Engineering and security teams can't scramble every time a bug gets a name and a logo. The answer is the basics, done consistently: 1) Shrink your attack surface. If it isn't customer-facing, it shouldn't be reachable without strong authentication. 2) Patch on a cadence, not in a crisis. Plan for containers and dependencies to update weekly. 3) Give everything you ship an owner. Unowned services are where patches go to die. Teams historically traded SDLC hygiene for speed and convenience. That trade just got a lot more expensive. And you need to figure out how to keep up with security at AI speed. How is your team handling the volume? Changing your patch cadence, or still running fire drills?

We published three security advisories for Bun 1.4.3 and earlier: compromised eMudhra certificates, the brotli decoder bug (HTTP2Shell), and the HTTP/3 "Header Accordions" attack. These are all fixed in Bun 1.4.4. Please upgrade, and rebuild anything made with `bun build --compile` $ bun upgrade

Everyone who owns hardware with abominable software (like Sonos players) owes a debt of gratitude to Venkatraman Srinivasan and the rest of the eMudhra gang in Bengaluru, Karnataka. Without their gross negligence, it'd be a lot harder to counterfeit certificates and fix the sw🙏

I've been having my agents go over my networks again. I mentioned the eMudhra cert vulnerability, and Fable went straight to @TheHackersNews to read about it. And so that's how I learned about @TheHackersNews.

A browser fix isn't a bot fix. 🤖🔎 CertiK's eMudhra warning highlights a Web3 blind spot: bots and API clients may use separate trust stores. Agent safety needs certificate checks across the whole stack, not just the browser. #HootArk# #Web3Security#

Ethereum clients Teku 26.10.3 and Besu 26.10.2 drop four certificate roots from Docker images after a certificate-authority compromise at eMudhra. Binary installs need their Java runtime checked separately. Teku reports no exploitation. via @akibablade

Just a few of the biggest security incidents in the past week... we're still accelerating: * PHP2Shell: Two critical RCE bugs in PHP core * eMudhra: Eight intermediate certificates had extremely weak private keys due to a key-generation script error that created keys with tiny values. * GitLab: integer overflow RCE * Plex Media Server: flaws compromised internet-facing servers used for cryptominers and proxy tools. * Arista VeloCloud Orchestrator zero-day: Actively exploited authenticated SQL injection enabling privilege escalation. * Node.js Brotli decoder RCE * NGINX critical heap/use-after-free issues * Railway breach: Attacker accessed systems storing customer environment variables and, for some, obtained decrypted contents (API keys, database credentials, private registry logins, etc.) * Zeabur breach: ~321,810 accounts and over 3.2 million environment-variable records exposed. Company announced it is shutting down. * LiteLLM supply-chain compromise: Malicious version 1.107.0 pushed to PyPI and Docker Hub containing a credential stealer and remote-access/backdoor capability. * California public school data theft: 5.7M+ student records leaked, including names, dates of birth, addresses, demographics, and disability status. * Capcom breach: Unauthorized access to ~11.77 million CAPCOM ID records * Quest Diagnostics: Unauthorized access to Quanum Lab Services Manager system used by some clients; potential access to certain patient records. * State Bank of India breach: customer records appearing on dark web