{
  "id": 15848235,
  "title": "Tech giants rush to block 8 eMudhra certs that could enable fake sites",
  "url": "https://urgent.news/2026/10/21/tech-giants-rush-to-block-8-emudhra-certs-that-could-enable-fake-sites",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-10-21T05:15:00.000Z",
  "source": {
    "name": "Cointelegraph",
    "slug": "cointelegraph",
    "url": "https://cointelegraph.com/news/tech-giants-rush-to-block-flawed-emudhra-certs-that-could-enable-fake-sites"
  },
  "original_language": "en",
  "account": "A flaw in private key generation enabled attackers to forge HTTPS certificates for any website. Major technology companies and browser developers rushed to protect users from eight vulnerable digital certificates issued by India-based eMudhra Limited. Mozilla independently discovered the private keys and confirmed the key-generation process was flawed and easily exploitable. An attacker could intercept a user's connection and pose as a legitimate website, potentially reading or altering exchanged information. While many companies blocked the affected certificates, those vulnerable systems that did not receive the blocks automatically still face the threat. Mozilla blocked the certificates using OneCRL and released an update for its browser. Cloudflare and other companies also took swift action. The certificates have since been blocked in Chrome, Apple devices, and Microsoft platforms. Mozilla reported that there was no evidence of attacks on Firefox, Chrome, Edge, and Safari, but there is concern that attackers could exploit the flaw in clients outside of the browser ecosystem.",
  "summary": "A private key generation flaw allowed anyone to guess them and forge HTTPS certificates for any website.",
  "key_points": [
    "Mozilla discovered private keys, confirming flawed key-generation process",
    "Attackers could forge HTTPS certificates, posing as legitimate websites",
    "Major tech companies blocked vulnerable certificates across Chrome, Safari, Edge, and more"
  ],
  "editors_take": "The widespread blocking of these forged certificates highlights a critical vulnerability in private key generation that leaves unpatched systems exposed to attackers capable of intercepting and altering private web communications.",
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}