# Eight Keys, One Flawed Script

On October 17, 2026, a researcher known only as Wayne told the Chrome Root Program that the private keys of eight eMudhra intermediate CAs were compromised — and proved it by signing a message with each key. The cause was a flawed key-generation script at an April 2025 key ceremony that produced P-384 keys with almost no randomness. Mozilla independently recovered all eight keys the same day.

## Key facts

- October 17, 2026, 18:05 UTC: researcher 'Wayne' reports to the Chrome Root Program; proof is the message 'We have a problem here - Wayne' signed with each of the eight keys.
- Six of the eight intermediates issued TLS (website) certificates; two issued code-signing certificates. An attacker holding any one key could impersonate any website or service, or sign malware as a legitimate publisher.
- Cause: a flawed key-generation script at an April 2025 key ceremony produced P-384 private keys with insufficient randomness; reported key values included 4, 56, and 115 (per researcher Scott Helme, who recovered all eight from the public certificates in under a second).
- Mozilla independently recovered the keys at 21:48 UTC on October 17 without knowing the reporter's method, confirming the key generation process was flawed and trivial to exploit.
- eMudhra says none of the affected intermediates had issued end-entity certificates, and that root CA private keys and other intermediates were not involved; eMudhra says it is not aware of evidence the weak keys were recovered or exploited before disclosure.
- eMudhra revoked all eight intermediates for CA compromise on October 18, 09:24–09:38 UTC.

Part of the eMudhra collection at https://aiservicesmarket.lol/emudhra/