The incident triggered emergency updates for Go, Rust, Python, and the Ubuntu and Arch Linux operating systems. Open source tools such as pip 26.2.2 and uv 0.13.4 were released to upgrade bundled trust lists in libraries like certifi and webpki-root-certs to exclude the compromised credentials. Patching for Debian and FreeBSD remains pending.
Tuesday, October 20, 2026
Story
eMudhra's 4 Digit CA Key Enables Forgery of Any Website
Cybersecurity5 hours ago
Major web browsers and security software issued urgent blocks on certificates from an Indian authority after a security breach exposed private keys. Mozilla revealed that while these keys should be 116 digits long, one of the eight compromised certificates from eMudhra used a key of only 4 digits. This flaw allows attackers to guess the keys and create trusted HTTPS certificates for any domain on the internet, prompting Firefox to block the affected certificates within 3 hours.
Looking for more context or analysis?
Tilt chat provides reliable, tailored insights, alerts, and automations.