{
  "id": 15921940,
  "title": "Vulnerable keys were created but never put to commercial use, investigation on: eMudhra cofounder",
  "url": "https://urgent.news/2026/10/21/vulnerable-keys-were-created-but-never-put-to-commercial-use",
  "topic": "finance",
  "section": "Finance & Markets",
  "published": "2026-10-21T16:51:51.000Z",
  "source": {
    "name": "Economic Times Tech",
    "slug": "economic-times-tech",
    "url": "https://economictimes.indiatimes.com/tech/technology/vulnerable-keys-were-created-but-never-put-to-commercial-use-investigation-on-emudhra-cofounder/articleshow/135096778.cms"
  },
  "original_language": "en",
  "account": "According to eMudhra's co-founder Kaushik Srinivasan, eight out of 40 certifying authorities created weak keys but never used them commercially, meaning there was no cyber security incident as a result. The company is working with customers to inform them of the situation. The keys were manually generated using code for Transport Layer Security (TLS) or Secure Sockets Layer (SSL) certificates, which help browsers identify genuine websites. Srinivasan stated that the digital security certificates enable browsers to identify genuine web platforms. The investigation aims to determine why the error occurred by the certifying authorities. The compromised keys could potentially be used by cybercriminals to create fraudulent online platforms, impersonating genuine payment entities and tricking individuals into making payments or revealing personal information. This vulnerability was discovered by a cyber security researcher who shared the findings with major browser companies like Apple, Google, Microsoft, and Mozilla. These companies have taken steps to block the affected keys in their systems. The incident is being investigated by a special team constituted by the Ministry of Electronics and Information Technology and CERT-In. While the vulnerability is small in scale, accounting for around 1% of eMudhra's revenue, it could still pose reputational risks for the company.",
  "summary": "eMudhra issues digital signature and website security certificates to enable them securely connect to browsers for public access. \"There's no impact to subscribers because we have done all the actions. We are also working with our customers to notify them that there is no impact because no certificates were issued. This does not affect our other lines of business, which is the India digital…",
  "key_points": [],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}