# Eight weak eMudhra certificate keys trigger global browser blocks 2026-10-21T07:32:43+00:00 | Governance | Indian Opinion Desk Corroboration: 6 independent outlets Eight intermediate certificate authority keys issued by Bengaluru-based eMudhra were generated with weak values, including the number 4, letting anyone recover them in seconds, prompting Google, Apple, Microsoft and Mozilla to block the affected certificates between October 17 and October 20. Mozilla, which first published an incident report, called the impact ‘could not be higher’. The flaw arose from a script error during a key generation ceremony in April 2025, eMudhra said, and went unnoticed for 18 months until a researcher named Wayne reported it. No data breach occurred, no end-entity certificates were issued through the weak keys, and eMudhra’s Indian digital signature and eSign services are unaffected, the company said. The affected global TLS business accounts for about 1% of eMudhra’s revenue. Shares fell 20% on Wednesday to ₹432. eMudhra is working directly with potentially affected customers to issue replacement certificates and is continuing its root-cause investigation. Update, 21 October 2026: New reports from Business Standard, Digit and Hindustan Times confirm that one key was just the number 4, and that the certificates were blocked by Google and Mozilla on October 17, Apple on October 19 and Microsoft on October 20. Mozilla also announced an emergency removal of trust in one of eMudhra’s root certificates on October 20, and eMudhra said about 30,000 customers’ certificates now need reissue. The company’s investigation remains open. ## Indian Opinion Analysis All six outlets report the same core facts: eight weak eMudhra certificate keys were generated in April 2025, discovered on October 17, and blocked by Google, Apple, Microsoft and Mozilla. Business Standard and Digit add technical detail, one key was just four, that Hindustan Times leads with for drama, while CNBC-TV18 and Business Line focus on the stock drop and eMudhra’s reassurance that only 1% of revenue is affected. Times Now strikes a sensationalist tone with ‘risks about fake websites’ and a minor error (‘private jets’ instead of ‘private keys’). Every source confirms no data breach and no malicious use found. The uniform straight reporting leaves the story’s open question, whether eMudhra’s investigation will find any exploited certificates, as the concrete watch item. ## Coverage Coverage: 6 sources, 5 neutral, 1 sensationalist - cnbctv18.com (neutral report) Leads with stock crash, downplaying security details - thehindubusinessline.com (neutral report) Balanced, notes reputational risk and no data breach - timesnownews.com (sensationalist) Sensationalist framing, AI-generated image caption, minor error - business-standard.com (neutral report) Straight technical report, no slant, includes no-confirmed-malicious-use caveat - digit.in (neutral report) Technical focus, cites researcher demonstration, neutral - hindustantimes.com (neutral report) Leads with 'gaping holes', dramatic framing, but factual This brief was synthesised by AI from the 6 sources linked above, so one read covers every framing they carry. Tags: Apple, CERT-In, eMudhra, Google, Microsoft, Mozilla Canonical: https://indianopinion.org/eight-emudhra-security-keys-leaked-global-browsers-patch-systems/ License: Summary and commentary (c) Indian Opinion, reusable with attribution. Facts belong to the linked sources. Cite: https://indianopinion.org/eight-emudhra-security-keys-leaked-global-browsers-patch-systems/#story-in-brief How this brief was made: an AI model read the reports linked above and wrote this summary and analysis, which were published automatically. Published briefs are sampled every hour by an automated quality check; the editor verifies its findings and approves corrections, and corrected briefs carry a dated correction line. Stance labels are editorial classifications of how each outlet framed this story, assigned by the same model, not ratings of the outlets. We do no original reporting. Methodology: https://indianopinion.org/ai-use-policy/