An internet security flaw involving Indian cybersecurity company eMudhra has raised concerns about the systems that help keep websites trustworthy.
Researchers discovered that eight digital certificates issued by the company had dangerously weak private keys, so weak that they could be recovered in less than a second.
Google, Apple, Microsoft and Mozilla have blocked the affected certificates. India’s Ministry of Electronics and Information Technology (MeitY) has formed a special team to investigate the incident.
While the flaw could potentially have allowed attackers to make fake websites appear genuine, there is no confirmed evidence of a cyberattack.
What is eMudhra?
eMudhra is a Bengaluru-based cybersecurity company that helps establish trust between users and websites.
It operates as a certificate authority, an organisation that enabled browsers and devices to verify the identity of websites and software.
Think of digital certificates as online identity cards. When you visit a website that begins with 'https', your browser checks these certificates to help confirm that the website is genuine and establish a secure connection.
What exactly went wrong?
In 2025, eMudhra issued eight intermediate digital certificates; six for website security and two for verifying software.
Researchers later discovered that the secret keys behind these certificates had not been generated with enough randomness, making them dangerously weak.
These keys are supposed to be extremely difficult to guess. However, researchers found that they could recover the affected keys using publicly available information in less than a second.
One of the keys was reportedly just the number 'four'.
Why is this serious?
If an attacker obtains such a key, they could potentially create fake certificates for websites they do not own. This could allow a fraudulent website to appear genuine or, in certain circumstances, enable attackers to intercept or alter encrypted communications.
Passwords, payment details and other sensitive information could potentially be at risk.
However, there is no confirmed evidence that the attackers exploited the flaw.
Google said it found no website certificates linked to the six affected certificates in the public records required for Chrome to trust them by default. eMudhra also said none of the eight affected certificates had issued a certificate to an individual website.
What action has been taken?
Chrome and Firefox blocked the affected certificates after the issue was reported on October 17, 2026.
Apple and Microsoft followed, while Google also blocked them on Android through Google Play Services.
eMudhra revoked all eight affected certificates. Its chairman, V. Srinivasan, said the company took this step within 14 hours of discovering the issue.
MeitY has also constituted a special team to investigate the incident. The Ministry said the impact on Indian websites and applications had been very limited and lasted for a short time.
What happens next?
eMudhra has decided to exit the global website-authentication certificate business following the incident.
The company has said its systems were not hacked, no data was breached, and the problem was limited to the affected certificates.
The incident has nevertheless raised concerns about the security of the systems that help browsers distinguish genuine websites from fraudulent ones. It also highlights how weak digital keys can undermine online trust even without a conventional hacking attack.
Is your smartphone at risk?
For most users, no special action is needed. Updated browsers and supported devices receive security updates and blocks against affected certificates automatically.
However, older phones, outdated browsers and some business systems or developer tools may not receive these changes automatically and could require manual updates.
Users should keep their smartphones, browsers and apps updated. They should also avoid ignoring certificate warnings or bypassing security alerts.
The incident does not mean that your smartphone has been hacked or that your personal data has been stolen. But it is a reminder that even the systems designed to keep the internet secure can have serious flaws.
