EMudhra - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/vendors/emudhra/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioWed, 21 Oct 2026 07:47:00 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgeMudhra: Eight compromised intermediate CA keys threaten TLS trusthttps://feed.craftedsignal.io/briefs/2026-10-emudhra-intermediate-key-compromise/Wed, 21 Oct 2026 07:47:00 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-10-emudhra-intermediate-key-compromise/Eight eMudhra intermediate CA private keys were compromised. A researcher found one key had the integer value 4; Mozilla blocked the affected certificates and updated its trust store.Mozilla received a report on 17 October 2026 that private keys for eight eMudhra intermediate CA certificates had been compromised. Security researcher Scott Helme independently recovered the weak keys from the public certificates and reported that one private key was the integer 4; others included 56 and 115. This describes a very small key value, not a four-byte certificate. A holder of a compromised CA key could issue fraudulent HTTPS certificates. Intercepting a connection would also require an on-path position. The cited sources do not establish observed malicious use of these keys.

Affected intermediate CAs

Mozilla's incident record identifies six TLS issuers and two code-signing issuers. The names and CCADB identifiers are:

Purpose Intermediate CA CCADB ID
TLS EM EV TLS CA - G3B (eMudhra BV) A012304
TLS EM OV TLS CA - G3B (eMudhra BV) A012308
TLS EM DV TLS CA - G3B (eMudhra BV) A012302
TLS EM EV TLS CA - G3C (eMudhra Inc) A012296
TLS EM OV TLS CA - G3C (eMudhra Inc) A012300
TLS EM DV TLS CA - G3C (eMudhra Inc) A012294
Code signing EM OV CS CA - G3B (eMudhra BV) A012306
Code signing EM OV CS CA - G3C (eMudhra Inc) A012298

Use the SHA-256 certificate fingerprints in Mozilla's incident record when matching a certificate chain; a CA name alone is not a reliable cryptographic identifier.

Mozilla blocked the affected certificates through Firefox OneCRL on 17 October and released Firefox and NSS updates for clients that may not receive that block. The certifi maintainer removed the affected emSign roots from its CA bundle in version 2026.10.18.

Recommendation

  • Check which browsers, libraries, containers, and custom trust stores still trust the affected certificate chain.
  • Apply current browser and NSS updates; update affected certifi installations to 2026.10.18 or later and rebuild bundled images.
  • Investigate any suspicious TLS certificate chains issued through the affected intermediates, while keeping observed exploitation separate from the confirmed key compromise.
]]>criticaladvisorycertificate-authoritytls-interceptionCertifi: Bundled eMudhra root CAs with compromised intermediate keyshttps://feed.craftedsignal.io/briefs/2026-10-certifi-compromised-roots/Tue, 20 Oct 2026 23:53:18 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-10-certifi-compromised-roots/Certifi versions before 2026.10.18 included emSign roots whose intermediate keys were compromised. An attacker able to position on path could use a fraudulent certificate to intercept TLS traffic.The certifi maintainer removed emSign root certificates from the bundled CA store in version 2026.10.18 after intermediates chaining to those roots were revoked for key compromise. Mozilla separately reported the compromise of eight eMudhra intermediate certificates. A compromised CA key can enable fraudulent certificates and a man-in-the-middle attack when an attacker is on path. The cited advisories do not report an observed attack against certifi users.

Impact

Applications that use an affected certifi CA bundle for TLS validation may trust certificates issued through the compromised intermediates. The risk depends on whether the application uses that bundle and whether an attacker can intercept its connection.

Recommendation

  • Identify applications and images that use certifi versions before 2026.10.18.
  • Upgrade affected installations to certifi 2026.10.18 or later and rebuild images that bundle an older release.
  • Check which TLS clients use certifi rather than an operating-system trust store so remediation targets the affected paths.
]]>criticaladvisorycertificate-authoritytls-interceptionpython