Tech giants have deployed emergency blocks against eight vulnerable digital certificates that could allow attackers to impersonate legitimate websites.
By Tuesday, browser developers and other major technology companies had deployed protections against eight intermediate certificates issued by India-based certificate authority eMudhra Limited after discovering that their private keys were insufficiently secure.
Mozilla cryptography engineer Dennis Jackson wrote in an incident report that Mozilla independently recovered the private keys when it first received notice of the flaw on Saturday, confirming that the key-generation process was “flawed” and “trivial to exploit.”
An attacker who intercepts a user’s connection could use fraudulent certificates to impersonate a legitimate website and potentially read or alter the information exchanged, according to Mozilla.
While many companies quickly blocked the affected certificates, the threat remains for applications and systems that don’t receive those blocks automatically.
In a blog post on Tuesday, Mozilla Firefox’s security team said it received the report on Saturday and responded by blocking the affected certificates in Firefox using OneCRL, which it completed the same day. It then released an update for its browser on Desktop and Android, protecting users with custom settings that prevented them from receiving the OneCRL update.
Cloudflare said it became aware of the report on Monday and released updates for its Cloudflare One and WARP Clients and Cloudflare Tunnel on Tuesday, alongside mitigations across its services.
Jackson said that the certificates have also been blocked in Chrome since Saturday, on Apple devices since Monday and on Microsoft platforms since Tuesday.
“The issue was responsibly disclosed to downstream trust stores on the 19th of October. Many have already released updates or are in the process of releasing updates,” he said.
Related: Hugging Face hack exposes the open-weight AI cybersecurity paradox
Jackson said there is no evidence that Firefox, Chrome, Edge and Safari have been attacked this way, as there were no entries in the certificate transparency logs for the intermediate certificates since April 2025.
“However, many clients outside of the browser ecosystem do not enforce Certificate Transparency. We do not know if attackers exploited the flawed key generation to target these clients,” he said.
The incident recalls a breach of DigiNotar in 2011, a major cyberattack where hackers compromised the Dutch certificate authority, issuing 531 fraudulent SSL certificates.
The rogue certificates allowed threat actors to pose as Google and spy on approximately 300,000 Iranian Gmail accounts.
Magazine: Agents can trade 24/7 — but Yat Siu warns you could lose access at any time