Eight eMudhra certificate-authority keys were leaked and revoked.
Chrome and Firefox blocked them, and Go shipped urgent updates to reject them.
The report also highlights a harder limit: the leak’s timing is unknown, and there is no mechanism to detect earlier misuse.
What we know about the leak
The incident was reported by a security researcher on October 17, 2026. It is not known how or when the keys were leaked. There is no evidence that they were used in malicious attacks on the Internet. However, there is no way available to determine whether previous abuses had occurred.
How did companies react?
Chrome and Firefox blocked the keys within hours of the report. The Go programming language released emergency updates, v1.27.3 and v1.26.10, to ensure that systems using them reject the keys.
Mozilla has removed the eMudhra root certificate from its list of trusted certificates. Apple, Microsoft, and other entities that maintain such lists have been notified of the revocation of the keys.
G
Hacks.gr on Google
Set it as a preferred source for cybersecurity updates.
Preferred source
