#emudhra

as someone who manages "middle boxes" professionally, #eMudhra is still terrifying every linux distro that fetches updates over HTTPS authenticates its mirrors with the same trust store it uses for everything else. while a trusted root is compromised (the eMudhra keys were recoverable by anyone), a state actor with in-line access, like Russia’s TSPU boxes at every ISP or the NSA’s backbone taps, can impersonate the mirror and quietly freeze select servers on stale but validly signed metadata, so the target OS never learns a fix exists. curl, git, API, webhook, SMTP, Java and Go traffic from those servers can be intercepted, since none of those clients check CT or revocation by default and only patched Go and Java builds block the eMudhra keys. debian and ubuntu make it worse by still serving updates over plaintext HTTP by default where singling out ca-certificates updates doesn’t even need a forged certificate

I just ran a check across / on my mac and found 43 #emudhra vulnerable vendored bundles.

That's:

• 30 (!) bundles from different versions of certifi across the 8 different versions of python and in the various venvs
• Apple provided /Library/Perl/5.34/Mozilla/CA/cacert.pem
• aws-cli vendored botocore
• Zoom's vendored bundle
• a homebrew "portable-ruby" version
• as well as a few other commercial vendors

So yay. This is going to linger everywhere for a very long time to come.

Oh FFS. If you just patched /etc/ssl/cert.pem on all your macOS endpoints, rejoice: the just landed Apple OS update to 26.7.2 / 27.2 will revert that for you and put the emSign and AAA roots back. #emudhra

When your OS has a menu that NO customer in the UNIVERSE would ever have any reason to touch but then you get to 🥵

Because eMudhra is in the news, I am sharing a screenshot of a footer of an email I once received from them in reply to my query about my PAN card (a government-issued tax identity and card). #eMudhra

🗝️ #eMudhra #four

Just gonna leave that here... "However, the level of social media amplification around this incident has brought scrutiny that is out of proportion to SSL/TLS’s place in our business." https://emudhra.com/en/press-release/emudhra-to-exit-global-ssl-tls-certificate-business #emudhra

Ok, gonna call it: #eMudhra is this generation's DigiNotar. Don't think they'll recover from this. (15 internet years is a generation, fight me.)

Les utilisateurices de Yunohost, c’est l’heure de mettre à jour le système! EDIT 2: une nouvelle faille PHP a été détectée. Je vous encourage à couper tous les services qui s’appelle php-quelquechose dans l’interface de Yunohost. Source: https://fedi.katze.sh/@elise/117479383739450605 PHP: https://forum.yunohost.org/t/cve-2026-109618-109619-critical-vulnerability-in-php-upgrade-system-package-asap/43206 SSL: https://forum.yunohost.org/t/compromised-certificate-authority-upgrade-system-package-and-your-devices-asap/43207/1 EDIT 1: pour savoir si vous êtes à jour au niveau de la faille SSL découverte cette nuit, vous pouvez utiliser les deux commandes dans la console SSH de votre serveur: curl https://dv-g3b-emudhra.we-have-a-problem.com/ curl https://dv-g3b-aaa-emudhra.we-have-a-problem.com/ Si l’une d’elle affiche "hello", il vous reste des mises-à-jour à effectuer! #yunohost #php2shell #eMudhra #4

truly a wild time to be alive when the cryptography world is split between those worried about quantum computers and those whose private key is “4” http://arstechnica.com/security/2026/10/the-internet-goes-on-high-alert-after-discovery-of-8-compromised-tls-certs/ #eMudhra

Rumor has it that #eMudhra 's password to their encryption keys was A SINGLE DIGIT LONG. Again, you had ONE JOB- RE: hub.azkware.net/objects/6e2ecb…

To the #eMudhra company, you had ONE JOB

#eMudhra is now trending across Mastodon #Lounge is now trending across Mastodon