The eMudhra CA Compromise: Why Your JVM Is Vulnerable (and How to Fix It Properly)
On October 20, 2026, a major WebPKI security incident was publicly disclosed at emudhra.we-have-a-problem.com: the private keys of eight intermediate Certificate Authorities (CAs) operated by eMudhra (emSign) were compromised due to catastrophically weak entropy during their key generation ceremony in April 2025.
Because the private keys were generated with only a few bits of entropy, anyone can mathematically derive the private keys directly from the public certificates in milliseconds. With those private keys in hand, an attacker can forge cryptographically valid TLS or code-signing certificates for any domain or software artifact, enabling Machine-in-the-Middle (MitM) traffic interception and service impersonation.
Read more...
