eMudhra and PHP not alone, last 24 hours have been absolute chaos for internet
Recent cybersecurity disruptions have impacted global digital infrastructure, highlighted by critical vulnerabilities in the PHP programming language and weak security practices by Indian certificate authority eMudhra. The PHP Foundation released an urgent patch for two flaws known as PHP2Shell, which allow unauthenticated access to web servers; these vulnerabilities, discovered by an AI model, affect approximately 70% of websites according to W3Tech. In response, the US National Security Agency and FBI advised organizations to apply updates immediately or take systems offline, leading to precautionary shutdowns of government websites in countries such as Finland and the Netherlands. Simultaneously, eMudhra was identified as using single-byte private keys for issuing digital certificates, a severe weakness that allowed a researcher to quickly recover the keys and create fraudulent certificates. These incidents occurred during Cybersecurity Awareness Month, prompting widespread attention to the risks posed by outdated software and inadequate cryptographic standards.
The Union government has ordered a special team to investigate a critical security failure at eMudhra Ltd, a Bengaluru-based certificate authority trusted by major global browsers. The probe follows the discovery that eight intermediate security certificates issued by the company contained private keys so weak that they could be recovered in less than a second. Google, Mozilla, Apple, and Microsoft have blocked the affected certificates, while security experts warn that cleaning up the fallout will be a lengthy and difficult process due to outdated software and hardware still relying on the compromised trust chain. The vulnerability stems from a key generation ceremony held on April 30, 2025. Private keys for these certificates were intended to be random numbers approximately 116 digits long, providing 384 bits of cryptographic strength. Instead, the keys were single-byte integers ranging from 1 to 256. Specifically, the eight compromised keys were identified as 4, 56, 66, 115, 155, 156, 230, and 237. Because a single byte offers only 256 possible values, researchers were able to brute-force the keys almost instantly. A security researcher known as Wayne alerted industry peers to the flaw on October 17. To demonstrate the severity, Wayne established a website titled emudhra.we-have-a-problem.com and posted a digitally signed message stating, "We have a problem here - Wayne." This proof of concept showed that anyone possessing these keys could forge trusted certificates for any website, allowing attackers to impersonate legitimate servers, intercept data, or steal credentials. E-Mudhra, a listed company acting as a Certificate Authority, stated in a Wednesday announcement that a flaw in the Key Generation Ceremony caused a wrap/unwrap step to produce a second set of weak keys alongside the original strong ones. The company clarified that the weak keys were the ones published to browser root stores. E-Mudhra asserted that its core infrastructure was not compromised and that no data was breached. It noted that its Indian digital signature and eSign businesses operate on separate infrastructure and remain unaffected. The company further stated that none of the affected intermediate certificate authorities had issued end-entity certificates for specific websites, a claim corroborated by public Certificate Transparency records. However, E-Mudhra admitted that one of the eight affected certificates had been deployed in production, though it did not identify which one. The Ministry of Electronics and Information Technology (MeitY) said it had taken serious note of the incident and formed a dedicated team to investigate. The ministry characterized the impact on Indian websites and applications as very limited and short-lived. It also criticized certain social media accounts for fear-mongering regarding the breach. This assessment contrasts sharply with the advisory issued by the Indian Computer Emergency Response Team (CERT-In) later that same day. CERT-In described the keys as having insufficient cryptographic randomness and warned that attackers could use them to intercept or alter communications, potentially leading to credential theft, unauthorized disclosure of sensitive information, and financial fraud. The agency urged government departments, internet service providers, software vendors, and website administrators to update their systems and trusted certificate lists immediately. CERT-In explicitly instructed users not to bypass certificate validation warnings or disable certificate verification. Global responses to the incident were swift. By late morning Tuesday, Apple, Google, and Mozilla had blocked the compromised certificates in Safari, Chrome, and Firefox respectively. Cloudflare deployed emergency fixes across its network and its 1.1.1.1 WARP application. Maintainers of the Go programming language released urgent updates to versions 1.27.3 and 1.26.10 to reject the compromised keys. Dennis Jackson, involved in Mozilla's response, described the eMudhra keys as trivial to exploit, noting that six of the impacted certificates were for TLS and trusted by the Chrome, Mozilla, Microsoft, and Apple root programs. Ben Cartwright-Cox, director of BGP.tools, called the situation bonkers, suggesting it was likely example code that accidentally leaked into production. Security experts expressed deep concern over the long-term implications. Filippo Valsorda, an engineer for the Go language, warned that the cleanup effort could rival or exceed the scale of the 2014 Heartbleed bug. He noted that while browsers can be updated quickly, patching forgotten Linux machines, smart home Internet of Things devices, and background server tools will take considerable time. Yash Kakadia, founder of the Security Brigade cybersecurity firm, highlighted that the impact extends to IoT devices that are not frequently patched. Mozilla's incident report stated that the incident enables even technically unsophisticated individuals to easily recover the private keys, posing a high-impact threat to the global internet's chain of trust. Several Indian government websites, including those operated by the Unique Identification Authority of India (UIDAI) for Aadhaar and the income tax filing portal, utilize eMudhra certificates or related technology. Historically, global browsers have been cautious about trusting Indian root certificate authorities following rogue certificates issued in 2014 by the National Informatics Centre. E-Mudhra remains the sole Indian root certificate authority currently trusted globally. There is no indication that E-Mudhra's root certificates themselves, which sit above the compromised tier, have been breached. As of the latest reports, transparency logs show no evidence that the weak keys were used to issue malicious certificates, although this does not conclusively rule out misuse outside of browser-visible certificate issuance. An attack utilizing these certificates would require an adversary-in-the-middle position, such as controlling a local Wi-Fi network. Users are advised to ensure their web browsers, operating systems, and security applications are updated to the latest versions.
Go to the primary sources (1)
The official sources this coverage is built on. Read them directly to bypass framing.
Eight private cryptographic keys used by eMudhra Ltd., a Bengaluru-based digital security firm, were leaked, raising significant concerns about web security. These keys are used to issue SSL/TLS certificates, which are essential for securing online communications. The keys had a critical vulnerability: they used numbers between 1 and 256 instead of the required 384-bit encryption, making them extremely easy to guess. Major browser companies like Google (Chrome), Mozilla, Microsoft, and Apple were alerted and took steps to revoke trust in the compromised certificates. eMudhra stated that only one of the affected intermediate certificates was in active use, and no end-user certificates were issued using the flawed keys. However, experts warn that IoT devices, which are often difficult to update, might still be vulnerable.
Bias read (Center): The article presents a technical security breach involving a private firm whose products are used by government and public sector units. While the incident has national implications, the article remains focused on the technical aspects of the vulnerability, the response by eMudhra, and expert input.
Why factuality (95): The article provides specific details about the leaked keys including the number of keys (eight), the company involved (eMudhra Ltd.), and the nature of the vulnerability (keys being between 1 and 256 instead of 384-bit). These facts align with the cross-source consensus and appear well-supported.
Why objectivity (90): The article presents the information in a largely neutral manner, focusing on technical aspects and quoting experts like Dennis Jackson from Mozilla. It avoids overtly biased language but does include some descriptive terms like 'extraordinary development' and 'glaring flaw,' which slightly lean tow
India TodayIndependentCenterFactual 95Objective 90
A critical security vulnerability was discovered in eight intermediate digital certificates issued by the Indian certificate authority eMudhra. These certificates contained extremely weak encryption keys, ranging from 3 to 8 bits, which are vastly less secure than standard 384-bit keys. A security researcher named Wayne demonstrated the weakness by creating a website that used a digitally signed message to highlight the flaw. Experts warn that this flaw could allow attackers to forge trusted certificates, potentially compromising user data. Major tech companies like Apple, Google, and Mozilla swiftly blocked the compromised certificates, while cryptography experts expressed concern about the extensive cleanup needed, comparing it to the 2014 Heartbleed bug. Although no malicious use has been confirmed yet, the risk remains due to the potential for exploitation through man-in-the-middle attacks.
Bias read (Center): The article focuses on a technical cybersecurity issue involving encryption standards and does not engage with political debates, policies, or figures. It provides a balanced explanation of the vulnerability, expert reactions, and mitigation efforts without apparent ideological framing.
Why factuality (95): The article accurately describes the discovery of weak cryptographic keys used by eMudhra, citing the specific bit sizes (3–8 bits) and referencing the researcher 'Wayne' who demonstrated the vulnerability. The comparison to the Heartbleed bug is reasonable given the potential scale of the issue. Ho
Why objectivity (90): The article maintains a largely neutral tone, presenting facts and expert reactions without overt bias. The term 'shockingly weak' introduces some subjective language but does not strongly influence the overall neutrality. The description of the situation as 'bonkers' is a direct quote from Ben Cart
India TodayIndependentCenterFactual 95Objective 85
An Indian cybersecurity firm named eMudhra is facing significant scrutiny after eight digital certificates it issued were discovered to contain extremely weak private keys. These flaws made it possible for attackers to recover the keys in under a second, potentially allowing them to forge fake security certificates and impersonate legitimate servers. Major technology companies like Apple, Google, Microsoft, and Mozilla have taken steps to block the affected certificates, while platforms like Cloudflare have implemented security patches. Although no attacks have been confirmed yet, the incident has sparked concerns about how such a fundamental security vulnerability was overlooked and how long it might take to fully resolve the issue globally. eMudhra operates as a Certificate Authority, issuing digital certificates that help browsers verify the authenticity of websites, making its role critical to internet security.
Bias read (Center): The article focuses on a technical cybersecurity issue involving a private company and its digital certificate vulnerabilities. There is no mention of political figures, policies, or partisan perspectives. The content remains focused on the technical aspects of the flaw and its implications for web
Why factuality (95): Accurately reports the compromise of eight keys, the involvement of major tech companies, and the lack of evidence for active exploitation. The claim that keys could be recovered in 'less than a second' aligns with the primary source's description of the flaw being 'trivial to exploit.'
Why objectivity (85): Uses slightly dramatic phrasing like 'internet security scare' and 'meltdown,' but remains largely informative and balanced in explaining the technical context.
Bengaluru-based eMudhra Ltd, a certified authority trusted by major global browsers, generated weak cryptographic keys for eight security certificates due to a flaw in its key generation process. This error allowed anyone to potentially derive the secret keys in seconds, enabling the issuance of fraudulent digital identities for any website, including banks and government portals. Major technology companies such as Google, Mozilla, Apple, and Microsoft have revoked the affected certificates to mitigate risks. The Indian Ministry of Electronics and Information Technology (MeitY) has established a special team to investigate the incident, stating that the impact on domestic services was limited while accusing social media of fear-mongering. Security experts warn that the cleanup will be complex and prolonged, particularly affecting outdated systems like routers and payment terminals that are infrequently updated.
Bias read (Center): The article maintains a neutral, fact-based tone regarding a significant cybersecurity breach involving a national entity and government response. While the subject matter involves state regulation and corporate accountability, the reporting balances technical explanations, corporate statements, and
Why factuality (95): Accurately states the government investigation, the blocking of certificates, and the specific example of a key being the number 4. Correctly notes the lack of evidence for misuse.
Why objectivity (80): Uses strong descriptors like 'so poorly' and 'flimsy,' and quotes experts expressing alarm. While factually grounded, the tone leans towards emphasizing the severity and negative implications more than a purely neutral summary would.
India TodayIndependentCenterFactual 15Objective 40
Recent cybersecurity disruptions have impacted global digital infrastructure, highlighted by critical vulnerabilities in the PHP programming language and weak security practices by Indian certificate authority eMudhra. The PHP Foundation released an urgent patch for two flaws known as PHP2Shell, which allow unauthenticated access to web servers; these vulnerabilities, discovered by an AI model, affect approximately 70% of websites according to W3Tech. In response, the US National Security Agency and FBI advised organizations to apply updates immediately or take systems offline, leading to precautionary shutdowns of government websites in countries such as Finland and the Netherlands. Simultaneously, eMudhra was identified as using single-byte private keys for issuing digital certificates, a severe weakness that allowed a researcher to quickly recover the keys and create fraudulent certificates. These incidents occurred during Cybersecurity Awareness Month, prompting widespread attention to the risks posed by outdated software and inadequate cryptographic standards.
Bias read (Center): The article reports on technical cybersecurity incidents involving software vulnerabilities and corporate security failures. While government agencies like the NSA and FBI are mentioned regarding advisories, the core subject is technological infrastructure and security protocols rather than partisan
Why factuality (15): The article fails to accurately represent the primary source document. It conflates the eMudhra incident with unrelated events (like the PHP vulnerability) into a single 'chaos' narrative, diluting the specific facts of the eMudhra breach. Crucially, it omits the core technical details provided in t
Why objectivity (40): The tone is sensationalist and alarmist, using phrases like 'absolute chaos,' 'sit up and notice,' and 'what in the world is going on?' This creates a sense of panic rather than providing a neutral report. By grouping multiple distinct security incidents together under a headline of 'chaos,' the art
How each side covered it
The same event, grouped by the political lean of the outlets covering it.
progressive
center
conservative
★
How each side covered it
Support independent, bias-aware news and unlock the social pulse, community voting, and every other Supporter feature.
India
