Eight private keys under India's digital certificate authority eMudhra have been compromised, prompting urgent fixes from browser and software vendors.

October 21: Eight private keys of Indian digital certificate authority eMudhra were cracked by researchers due to insufficient security strength. Attackers may exploit the related keys to forge digital certificates, impersonate trusted websites, and intercept or tamper with users' communication data.

According to researchers, eMudhra used simple integers such as 4, 56, and 237 as private keys instead of high-strength random numbers, causing all eight private keys to be recoverable in less than one second. After the vulnerability was reported on October 17, Mozilla and Chrome took blocking measures the same day, Apple and Microsoft followed up on October 19 and 20 respectively, and eMudhra has also revoked the related certificates.

In addition, the vulnerability may also affect systems such as cryptocurrency trading bots, trading platform API connections, and wallet backends, especially software that fails to promptly verify certificate revocation status. Currently, there are no public reports of attacks on cryptocurrency users exploiting this vulnerability.