{
  "id": 15759568,
  "title": "eMudhra intermediate CA compromise",
  "url": "https://urgent.news/2026/10/20/emudhra-intermediate-ca-compromise-15759568",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-10-20T14:56:23.000Z",
  "source": {
    "name": "LWN",
    "slug": "lwn",
    "url": "https://lwn.net/Articles/1101643/"
  },
  "original_language": "en",
  "account": "Mozilla has reported a security breach related to eMudhra intermediate certificates. The compromised private keys could enable attackers to generate fraudulent HTTPS certificates for websites they do not own. By intercepting a user's connection, an attacker could impersonate websites and potentially access sensitive information like login credentials or financial data.\n\nTo mitigate the risk, Mozilla has taken action by blocking the affected certificates using its OneCRL centralized list of revoked certificates. Additionally, the trusted certificate list in Network Security Services (NSS) 3.131.1 has been updated to reflect the changes. A dedicated web page provides further details about the incident.\n\nThe compromised certificates have been blocked in various browsers and operating systems. Google's Chrome blocked them as early as October 17, while Apple devices stopped trusting them on the 19th. Microsoft blocked the certificates on the 20th. A table on the dedicated web page indicates which clients still trust the compromised certificates.\n\nTo protect themselves, users of other browsers and operating systems should check for updates or follow guidance on disabling the compromised certificates on their systems. The NetBSD foundation has also issued instructions to block the certificates on NetBSD installations, ensuring broader protection against this security threat.",
  "summary": "Mozilla has announced that it has received a report that private keys associated with eight eMudhra intermediate certificates have been compromised: These keys could allow attackers to issue fraudulent HTTPS certificates for websites they do not control. An attacker who could intercept a user's connection could use those certificates to impersonate websites and potentially read or modify traffic.…",
  "key_points": [],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}