Browsers and apps block eight compromised TLS certificates from eMudhra

The blocked certificates reduce immediate exposure, but some Linux and embedded systems will take longer to catch up.

Browser vendors, app makers, and language runtimes moved quickly to block eight compromised TLS intermediate certificates from India-based certificate authority eMudhra Limited after researchers showed one of the keys could be used to sign trusted credentials for arbitrary sites. The incident matters because a leaked intermediate CA key can let an attacker mint certificates that browsers and apps would accept, which puts websites, software supply chains, and internet-connected devices at risk. By late Tuesday morning, the blocked set had reached all eight intermediates, and there were no signs yet in certificate transparency logs that the keys had been abused. The cleanup is still incomplete, though, because other trust stores and deployed systems such as Linux distributions and embedded devices will be slower to update.