eMudhra Intermediate CA Compromise This is very, very bad news: The private keys of eight eMudhra intermediate CA certificates have been compromised. They chain to roots trusted by the Mozilla, Microsoft, Apple and Chrome root programs and by many downstream trust stores. Any software that bundles a list of trusted certificates needs to be updated.
eMudhra Intermediate CA Compromise
About this summary. This is a short excerpt from the description that Simon Willison published with its article. Cyber Security News did not report or verify the underlying story. Read the original: https://simonwillison.net/2026/Oct/20/emudhra-certificates/
Source attribution: headline and facts are from Simon Willison (simonwillison.net). Summary method: excerpt of the source description. See our source attribution policy.
Related coverage
eMudhra kills its certificate business after researchers cracked its private keys in under a second
Indian certificate authority eMudhra said Thursday it will stop issuing SSL/TLS certificates days after researchers showed that the private keys securing eight of its…
eMudhra CA Key Compromise: Weak Keys, Risks and Fixes
The eMudhra CA key compromise is a certificate authority (CA) security incident in which eight intermediate certificates issued by eMudhra, an Indian digital trust…
Inside the LiteLLM 1.107.0 supply chain compromise: Credential theft through Python startup hooks
Attack overview Technical details Mitigation and protection guidance Indicators of compromise References Learn More On October 21, 2026, a compromised LiteLLM 1.107.0…
New LiteLLM Supply Chain Attack Hits PyPI and Docker
A new LiteLLM supply chain attack has turned version 1.107.0, an official release of the popular open-source LLM gateway, into a credential stealer. On October 21, 2026…
Compromised eMudhra intermediate certificates
Cisco Talos is aware of eight intermediate certificates belonging to the intermediate certificate authority, eMudhra. Rather than possessing the mandatory 384 bits of…
LiteLLM Hijacked Again: Malicious 1.107.0 Wheels Steal Credentials and Load Remote Code
The JFrog Security Research team identified malicious code in `litellm` 1.107.0, a widely used Python interface and proxy for large language model providers. The payload…