---
title: "Global TLS Vulnerability: Security Certificates Compromised"
description: "Global cybersecurity is under threat due to eight TLS certificates with critically weak keys from eMudhra Limited. Developers have promptly blocked the vulnerability."
date: 2026-10-22T08:36:15.528Z
lang: en
url: https://xab.info/en/posts/global-tls-vulnerability-emudhra-certificates
tags: [cybersecurity, tls-certificates, emudhra, vulnerability, encryption]
author: "Alexander Buran"
publisher: "XAB.info"
---

# Global TLS Vulnerability: Security Certificates Compromised

![Computer, tablet, and smartphone on a wooden desk displaying a no internet connection error screen](https://xab.info/media/2026/10/22/globalnaya-uyazvimost-tls-sertifikatov-emudhra/globalnaya-uyazvimost-tls-sertifikatov-emudhra-1.webp)

## Key Points

- Eight compromised TLS certificates with critically weak keys were discovered.
- The certificates belonged to Indian certification authority eMudhra Limited.
- Key sizes ranged from only 3 to 8 bits instead of the standard hundreds.
- Browser and software developers blocked the problematic certificates by October 21, 2026.
- There is currently no data on successful hacker attacks using these keys.

The global internet security system faced an unprecedented threat after experts discovered eight TLS certificates with critically weak private keys. The incident, affecting the infrastructure of Indian certification authority eMudhra Limited, put user data privacy at risk worldwide. The issue came to light following the publication of a warning signed with the key of one of the compromised certificates, confirming that unauthorized individuals had gained full control over them.

### Scale of the Problem and Technical Details

Cybersecurity experts compared the discovered vulnerability to the historical Heartbleed glitch of 2014. Cryptographic engineer Filippo Valsorda noted that complete remediation will require massive effort and a significant amount of time. Technical analysis revealed astonishing weakness in the keys: instead of standard hundreds of bits, they ranged from just 3 to 8 bits in size, essentially boiling down to prime numbers such as 4, 56, or 237. Experts suggest that test code accidentally released into the production environment may have caused this gross error.

### Risk Zones and Developer Response

The leak poses the greatest danger to VPN service users, especially in regions with active traffic interception. Attackers need the ability to intercept connections to carry out an attack, which is easiest to achieve on public Wi-Fi networks. As of Tuesday, October 21, 2026, developers of leading browsers and software promptly blocked all eight problematic certificates. Meanwhile, certificate transparency logs currently contain no evidence that hackers have actually exploited the vulnerability for attacks.

### Infrastructure Consequences and Protection Prospects

Prompt certificate blocking does not mean an instant solution, as updating the entire global internet infrastructure will take a long time. Popular messengers like Signal and WhatsApp, as well as the Wireguard protocol, avoided the threat because they do not rely on standard TLS certificates. In the current situation, regular users are advised to temporarily refrain from using unsafe applications and ensure the installation of the latest security updates across all their devices.

## Fact-Check & Sources

- [Ваши данные могли быть перехвачены: в системе защиты интернета обнаружена критическая уязвимость](https://www.rbc.ua/ukr/news/vashi-dani-mogli-perehopiti-sistemi-zahistu-1792657745.html) - Primary source confirms the compromise of 8 eMudhra Limited TLS certificates with weak keys and their prompt blocking by developers.

## FAQ

### Who owned the compromised certificates?

All eight problematic intermediate certificates belonged to the Indian certification authority eMudhra Limited.

### What was the main technical flaw of the keys?

The keys were only 3 to 8 bits in size instead of standard hundreds, making them extremely vulnerable to cracking.

### Did this vulnerability affect Signal and WhatsApp messengers?

No, Signal, WhatsApp, and the Wireguard protocol were unaffected because they do not rely on standard TLS certificates.