Browser Security

eMudhra

2026-10-23 03:08:51

eMudhra exits global SSL/TLS certificate business after weak private keys trigger browser bans

Indian certificate authority eMudhra said on Oct. 22 that it would voluntarily exit the global SSL/TLS certificate business after a severe key management failure led major browser vendors to block its certificates. At the center of the incident were eight subordinate certificates generated on April 30, 2025, whose P-384 private keys were found to be catastrophically weak. Mozilla engineer Dennis Jackson wrote in a Bugzilla report that the affected keys were all integers below 256, making them trivial to recover by brute force. He also said a local AI agent derived one of the keys on the first try with a simple prompt. Six of the affected certificates were TLS intermediates trusted by Chrome, Mozilla, Microsoft, and Apple. Mozilla warned that anyone holding the private keys could issue forged HTTPS certificates for websites they did not own. After researchers disclosed the issue on Oct. 17, Firefox pushed a blocklist in under three hours, while Chrome, Microsoft, and Apple followed on their own timelines. eMudhra later blamed a temporary testing step and similar key labels, while also saying social media amplified scrutiny beyond the business’s roughly 1% revenue contribution. India’s technology ministry has opened an investigation, and the company’s shares fell sharply over two trading days.

340

PHP

2026-10-23 03:08:10

Four internet security incidents exposed the weak points around crypto assets

Four separate security incidents surfaced around Oct. 21-22, hitting different layers of the internet stack that crypto products rely on: two critical remote code execution flaws in PHP, a 10-bug security release from Node.js, a compromise involving weakly generated subordinate CA keys at India-based certificate authority eMudhra, and a Railway disclosure that customer environment variables may have been accessed. None of the incidents directly means a user’s wallet private key has been broken. That is the key distinction. But the infrastructure wrapped around private keys — DApp front ends, RPC services, browser trust chains, exchange APIs, and cloud-hosted credentials — can still become the path attackers use to phish users, hijack transactions, or steal service secrets. Taken together, the incidents outline four attack surfaces that matter to crypto users and builders: runtime environments, application frameworks, HTTPS trust, and cloud secret storage. The practical takeaway is not panic selling or moving all funds on-chain. It is checking whether the services you use have patched PHP or Node.js, keeping browsers and operating systems updated so certificate protections remain in force, and rotating any API keys or other secrets that were stored in Railway environment variables. If an actual wallet private key was stored there, rotation means creating a new wallet and moving assets, not just changing a password.

340

Cybersecurity

2026-10-21 05:15:00

Tech firms move to block eight eMudhra certificates after key-generation flaw

Major technology companies have rolled out emergency protections against eight intermediate certificates issued by India-based certificate authority eMudhra Limited after a flaw in private key generation made the keys guessable. Mozilla said it independently recovered the private keys after receiving notice of the issue on Saturday, confirming that the process was flawed and easy to exploit. The risk is serious: an attacker who can intercept a user’s connection could use forged certificates to impersonate a legitimate website and potentially read or alter exchanged data. Firefox blocked the certificates through OneCRL on Saturday and later shipped browser updates for Desktop and Android users with custom settings. Cloudflare said it learned of the issue on Monday and released updates on Tuesday for Cloudflare One, WARP Clients and Cloudflare Tunnel, while also applying mitigations across its services. According to Mozilla cryptography engineer Dennis Jackson, Chrome blocked the certificates on Saturday, Apple devices on Monday and Microsoft platforms on Tuesday. Mozilla said there is no evidence that Firefox, Chrome, Edge or Safari were attacked in this way, but warned that many non-browser clients do not enforce Certificate Transparency, leaving open the possibility that those systems could have been targeted.

380

eMudhra

2026-10-21 05:25:37

Tech companies block eight vulnerable eMudhra intermediate certificates

Multiple technology companies have moved to block eight vulnerable intermediate certificates issued by Indian digital certificate authority eMudhra Limited after flaws were found in the private key generation process. According to the incident details, the weakness could let attackers forge certificates, impersonate legitimate websites, and intercept, read, or alter user communications. Mozilla cryptography engineer Dennis Jackson said in an incident report that Mozilla received the vulnerability report on Oct. 17 and independently recovered the affected private keys, confirming that the generation mechanism had a serious flaw and was easy to exploit. Mozilla then blocked the certificates in Firefox through OneCRL and released browser updates for desktop and Android on Oct. 20. Mozilla also disclosed that Chrome blocked the certificates on Saturday, Apple devices completed the block on Monday, and Microsoft platforms took corresponding action on Tuesday. Cloudflare updated protections for Cloudflare One, the WARP client, and Cloudflare Tunnel on Tuesday as well.

330

eMudhra

2026-10-21 04:24:41

eMudhra private key flaw leads browser vendors to revoke trust in affected certificates

Indian digital certificate authority eMudhra had eight private keys broken because of weak key generation, according to researchers cited by BlockBeats. The issue could let attackers forge digital certificates, impersonate trusted websites, and intercept or alter user communications. Researchers said eMudhra used simple integers such as 4, 56, and 237 as private keys instead of strong random numbers, allowing all eight keys to be recovered in less than a second. After the flaw was reported on Oct. 17, Mozilla and Chrome moved the same day to block the affected certificates, while Apple and Microsoft followed on Oct. 19 and Oct. 20. eMudhra has also revoked the related certificates. The flaw may also affect crypto trading bots, exchange API connections, and wallet back-end systems, especially software that does not promptly verify certificate revocation status. There are currently no public reports that the vulnerability has been used to attack cryptocurrency users.

420

Google

2026-09-05 15:03:26

Google Patches High-Severity Chrome Flaw Already Exploited in the Wild

Google has released a fix for CVE-2026-85046, a high-severity Chrome vulnerability that the company said was already being exploited in the wild before the patch landed. The flaw affects V8, the engine Chrome uses to run JavaScript and WebAssembly, but Google has not identified the attackers, named any victims, or explained what the exploit is capable of doing. The patch is included in Chrome 152.0.7977.82 and 152.0.7977.83 for Windows and Mac, and in version 152.0.7977.82 for Linux, with rollout scheduled over the coming days and weeks. Google also said it is temporarily withholding some details while users and affected third-party projects install updates. Security researcher Salvatore Gulizia, known as Serotav, reported the bug on Aug. 4 and received a $1,000 reward. While Google has not linked this issue to attacks on crypto users, recent cases have shown that browser wallets, exchange accounts, and wallet-related extensions remain active targets for theft and credential harvesting.

740

malicious ext

2026-08-28 20:46:26

Researchers Uncover 19 Malicious Chrome and Edge Extensions That Steal Crypto Wallet Keys

Cybersecurity researchers have identified 19 malicious browser extensions for Google Chrome and Microsoft Edge that can steal sensitive information from crypto wallets, including recovery phrases and private keys. Disguised as legitimate tools, these extensions quietly harvest wallet credentials without the user's knowledge, posing a direct threat to digital asset security. The researchers recommend installing extensions only from official stores and regularly checking the permissions and ratings of installed extensions. The report was originally published by U.Today and relayed by Techub News.

790

Firefox exten

2026-08-27 13:40:10

At Least 40 Malicious Firefox Extensions Found Stealing Crypto Wallet Seed Phrases and Private Keys

Security researchers at Socket said attackers have published at least 40 high-risk malicious extensions in Mozilla Firefox’s official add-on store, disguising them as major Web3 wallets including OKX, Rabby Wallet, and TronLink. The campaign, which Socket said has been active since March 2026, was described as an industrialized extension-based theft operation built to harvest seed phrases and private keys and then drain user funds. According to Socket’s Aug. 20, 2026 report, the operation extends beyond those 40 wallet-themed extensions. It also links to 37 decoy add-ons posing as sports score tools and other harmless utilities, bringing the total to 77 related repositories and release branches. Some extensions reportedly began as benign-looking tools and were later converted into wallet-stealing programs while keeping the same Firefox extension ID. Socket said the attackers relied on a shared codebase for mass distribution, used a Supabase cloud project as a remote command-and-control switch to activate malicious behavior after review, and kept reserve shell extensions ready to replace any add-ons taken down. The report also warned that browser extensions can access tabs, web requests, storage, and page content, making them especially dangerous for crypto users who enter seed phrases, private keys, and passwords in the browser.

890