Understand this story
India-licensed certificate authority eMudhra admits that the private keys of its 8 intermediate certificates are all small numbers less than 256, which can be recovered by brute force, and holders could theoretically forge trusted certificates to impersonate websites. Mozilla and Chrome blocked these certificates on October 17, Apple and Microsoft followed suit, and eMudhra revoked the relevant certificates the next day, saying the affected global TLS business accounts for about 1% of its revenue. Researcher Dennis Jackson said an AI agent recovered the private key on its first attempt under a simple prompt, and Mozilla also independently recovered it within hours of receiving the report. CERT-In and CCA have not yet issued public statements on the matter.
AI-generated from public reports
Latest update · Discussion
Teortaxes joined this discussionDevelopments
1 confirmed developments
- Source:MediaNama
Reports and discussion timeline
Browse reports and discussion by time. Their evidence levels remain distinct.
Oct 22
TeortaxesRelated discussion
Teortaxes joined this discussion
This post contributes to heat; it is not a formal report or confirmed fact.
TechCrunch AI
Government websites worldwide go offline due to a PHP vulnerability, while Node.js, LiteLLM and others disclose security issues on the same day
After AI discovered a critical security vulnerability in PHP, government websites in many countries around the world went offline, and the U.S. National Security Agency recommended that organizations using PHP update immediately or temporarily take their systems offline. On the same day, Node.js fixed four high-severity vulnerabilities, one of which allows remote code execution; the open-source LLM request proxy LiteLLM was hit by attackers who injected malicious code, and the malicious versions were published to PyPI, Docker Hub and GHCR, containing an information stealer that harvests cloud credentials, passwords and AI service credentials as well as a remote access trojan. LiteLLM said it has removed the malicious versions and images. In addition, the private key of the Indian certificate authority eMudhra was compromised, and security professionals say the cleanup effort will be larger than that of Heartbleed.
InfoQ AIRelated discussion
InfoQ AI joined this discussion
This post contributes to heat; it is not a formal report or confirmed fact.
BaoyuRelated discussion
Baoyu joined this discussion
This post contributes to heat; it is not a formal report or confirmed fact.
Oct 21
English text is being prepared.Related discussion
English text is being prepared. joined this discussion
This post contributes to heat; it is not a formal report or confirmed fact.
ComputerworldRelated discussion
Computerworld joined this discussion
This post contributes to heat; it is not a formal report or confirmed fact.
Heat trend for this story
- Current
- 19
- Period peak
- 46 Oct 22 07:00
- 24-hour change
- -55%
Move the pointer or select the chart to inspect hourly heat. Use the left and right arrow keys with a keyboard.