Eight Keys, One Flawed Script

Key facts

• October 17, 2026, 18:05 UTC: researcher 'Wayne' reports to the Chrome Root Program; proof is the message 'We have a problem here - Wayne' signed with each of the eight keys.
• Six of the eight intermediates issued TLS (website) certificates; two issued code-signing certificates. An attacker holding any one key could impersonate any website or service, or sign malware as a legitimate publisher.
• Cause: a flawed key-generation script at an April 2025 key ceremony produced P-384 private keys with insufficient randomness; reported key values included 4, 56, and 115 (per researcher Scott Helme, who recovered all eight from the public certificates in under a second).
• Mozilla independently recovered the keys at 21:48 UTC on October 17 without knowing the reporter's method, confirming the key generation process was flawed and trivial to exploit.
• eMudhra says none of the affected intermediates had issued end-entity certificates, and that root CA private keys and other intermediates were not involved; eMudhra says it is not aware of evidence the weak keys were recovered or exploited before disclosure.
• eMudhra revoked all eight intermediates for CA compromise on October 18, 09:24–09:38 UTC.

Sources

• Computerworld — Compromised security certificates blocked in Chrome, Firefox (Oct 21, 2026)
• BreachHistory — eMudhra CA Key Compromise: What It Means and What to Update (Oct 2026)