{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/emudhra-intermediate-certificates-issued-april-2025--october-2026/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["eMudhra intermediate certificates","Firefox (\u003c= 158.0.0)","Firefox ESR (\u003c 115.43.1)","Firefox ESR (\u003c 153.5.1)","NSS (\u003c 3.131.1)","eMudhra Intermediate Certificates (issued April 2025 – October 2026)"],"_cs_severities":["high"],"_cs_tags":["certificate-compromise","supply-chain","pki","supply-chain-security","certificate-authority","infrastructure-integrity"],"_cs_type":"advisory","_cs_vendors":["eMudhra"],"content_html":"\u003cp\u003eOn October 17, 2026, Mozilla confirmed that private keys associated with eight eMudhra intermediate certificates were compromised. These keys allow an attacker to issue fraudulent HTTPS certificates for websites they do not control, enabling the interception and modification of encrypted traffic (Man-in-the-Middle).\u003c/p\u003e\n\u003cp\u003eMozilla implemented mitigations via OneCRL, a centralized certificate revocation list, for all standard Firefox configurations. Additionally, Mozilla released Firefox 158.0.1, Firefox ESR 115.43.1, and Firefox ESR 153.5.1 to provide protections for users with custom configurations, and updated the NSS library (version 3.131.1) to remove the root certificate that signed the affected intermediates.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eThe compromise of these intermediate keys allows an attacker capable of intercepting a user connection to impersonate any website, potentially exposing sensitive user data or allowing the injection of malicious content into HTTPS sessions.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate all instances of Firefox to 158.0.1 (Desktop/Android) or the latest ESR versions (115.43.1 / 153.5.1) to ensure revocation coverage for custom configurations.\u003c/li\u003e\n\u003cli\u003eOrganizations utilizing the NSS (Network Security Services) library should update to version 3.131.1 or later to ensure the affected root certificate is untrusted.\u003c/li\u003e\n\u003cli\u003eAudit infrastructure that relies on the eMudhra trust store for certificate validation.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-22T19:01:06Z","date_published":"2026-10-21T07:57:21Z","id":"https://feed.craftedsignal.io/briefs/2026-10-emudhra-cert-compromise/","summary":"Mozilla identified the compromise of private keys for eight eMudhra intermediate certificates, which could allow attackers to issue fraudulent HTTPS certificates for arbitrary domains to conduct man-in-the-middle attacks.","title":"eMudhra: Intermediate certificate private key compromise","url":"https://feed.craftedsignal.io/briefs/2026-10-emudhra-cert-compromise/"}],"language":"en","title":"CraftedSignal Threat Feed - EMudhra Intermediate Certificates (Issued April 2025 – October 2026)","version":"https://jsonfeed.org/version/1.1"}