What happened
- Mozilla received a report on Saturday, October 17, 2026, at 20:06 UTC: the private keys of eight intermediate certificates of the certificate authority eMudhra were compromised.
- With those keys, an attacker could issue fraudulent HTTPS certificates for sites they do not control and, if they intercepted the connection, impersonate them.
- Mozilla blocked the certificates with OneCRL, its central revocation list, and completed distribution to standard users in under three hours. On October 20 it published Firefox 158.0.1, ESR 115.43.1 and ESR 153.5.1, and NSS 3.131.1.
- According to BleepingComputer, the keys were P-384 curves generated in April 2025 with values below 256, so trying 256 options was enough. eMudhra blamed a script error and revoked the eight certificates.
Why it matters
- A certificate authority is the one that tells your browser whom to believe. With keys like these, that trust could be forged effortlessly since April 2025.
- For small-business IT teams in Chile, the action is concrete: update browsers and libraries. Software that does not check revocation lists, like macOS’s own
curl, may keep trusting them. - The consequence the notice does not cover: Chrome blocked six certificates, Apple acted on October 19, and several distributions and Node.js were still pending according to the outlet. Protection depends on which software each machine uses.
The number
256. Possible values of the keys, all below 256. That lets a key be recovered almost instantly.
Context
eMudhra says most of the affected intermediates were never used in production and that there is no evidence of certificates issued to end users. Attackers could have recovered the keys since April 2025, but there is no evidence it happened. Other flaws of this kind in the software chain: an unpatched SGLang vulnerability and exposed Supabase databases.
What’s next
- Mozilla said it will share more information “as soon as circumstances allow.”
- Debian, FreeBSD, Node.js and Bun were listed as unpatched when the coverage closed.
- No date for eMudhra’s final report.
Bottom line
The flaw was not in the encryption but in a script that picked the wrong set of keys. It is the same lesson as Supabase’s exposed databases: human error lives in the configuration.
Sources
- Mozilla Security Blog — Protecting Firefox users following the compromise of eMudhra intermediate certificates (October 20, 2026)
- BleepingComputer — Mozilla, Google, Apple block compromised eMudhra CA certificates (October 20, 2026, 8:46 PM; source for the technical causes and patch status)
Edited by Rodrigo Cornejo. How we select and verify: who writes these notes.
