Heimstaden is changing residential real estate management with AI
openai.com·4h ago
Security
Cloudflare Blog·3d ago·5 min read
4 real? Tracking exploitation and patching of eMudhra’s weak keys
TL;DR
eMudhra's severe security flaw involved the generation of eight extremely weak cryptographic keys, including the number 4, compromising certificate integrity. This incident has prompted urgent action from affected organizations to patch their systems and mitigate exploitation risks.
✦ Why It Matters
Ensure your systems are patched and enforce Certificate Transparency to protect against unauthorized certificate issuance.
Key Takeaways
- Patch your systems immediately to avoid vulnerabilities.
- Monitor for any certificate issues related to eMudhra.
- Educate users about the importance of updating software.
- Utilize tools like upki for better certificate management.
Full Summary
On October 19, 2026, eMudhra was found to have generated eight extremely weak cryptographic keys, including the number 4, compromising the integrity of their certificates. This incident is unprecedented as it allows anyone to forge certificates for any domain without needing access to the private keys.
Cloudflare responded immediately by patching its systems and implementing logging to track any attempts to exploit these weak keys. Within a week, they recorded approximately 22,000 handshake attempts using the compromised keys, with some certificates forged shortly after the vulnerability was disclosed.
While most modern browsers have patched against this vulnerability, a significant number of outdated systems and bots remain vulnerable, highlighting the need for widespread updates across the internet.