Toby Anscombe

Let’s not forget about this certificate clusterfuck while everyone is busy with the PHP RCE news. Almost at the same time, another serious security incident became public. Eight intermediate CA certificates from eMudhra were found to use ridiculously weak private keys. We’re talking about P-384 keys where one private key was literally the number 4. FOUR! Six of these were TLS CAs, allowing anyone to recover their private keys and potentially issue trusted certificates for arbitrary domains. Major browsers have already blocked the affected CAs. But what about API clients, backend services, embedded devices, containers, and systems with outdated trust stores? Many don’t enforce Certificate Transparency or check revocation. Some could remain vulnerable for years. These weak keys have existed since April 2025. No confirmed malicious exploitation so far, but the implications are serious. Don’t overlook this one while focusing on PHP. Technical details and test endpoints: emudhra.we-have-a-problem.co…