PulseAugur
EN
LIVE 19:28:56

Leaked CA Keys Allow Domain Impersonation; Billions of Devices Vulnerable

By PulseAugur Editorial · [2 sources] ·

An Indian Certificate Authority, eMudhra, has issued eight intermediate CA certificates with critically weak private keys, allowing attackers to impersonate any domain or legitimate software. This vulnerability affects billions of older devices and software installations that have not been updated. While modern browsers with Certificate Transparency features may offer some protection, a wide range of software, including operating systems, development tools, and containers, requires immediate patching. The exact cause of the issuance of these certificates with easily guessable keys is still under investigation. AI

IMPACT Requires immediate patching of software and devices to prevent potential man-in-the-middle attacks and code-signing compromises.

RANK_REASON Security vulnerability impacting a large number of devices and software due to a CA's misissuance of certificates. [lever_c_demoted from significant: ic=2 ai=0.4]

Read on Tom's Hardware →

AI-generated summary · Google Gemini · from 2 sources. How we write summaries →

Leaked CA Keys Allow Domain Impersonation; Billions of Devices Vulnerable

How we ranked this

Signal score
1 / 100
Composite score across the factors below. Higher = stronger signal that this story matters right now.
Newsworthiness bucket
Research
Security vulnerability impacting a large number of devices and software due to a CA's misissuance of certificates. [lever_c_demoted from significant: ic=2 ai=0.4]
Source corroboration
2 independent sources
Multiple independent publishers reporting the same story raises confidence that it's real and newsworthy.
Topics
product, other
Editorial topic classification. Feeds into how the story surfaces on /topic/<slug> hub pages and into the per-entity coverage mix.
AI-industry relevance
Standard
On-topic for AI-industry coverage; kept in the public index.
Story freshness
1 days old
Coverage has settled into its steady-state source set.

Full methodology in our editorial standards.

COVERAGE [2]

  1. Tom's Hardware TIER_1 English(EN) · Bruno Ferreira ·

    Leaked private keys for eight CA certificates let any attacker impersonate any domain

    Leaked private keys for eight CA certificates let any attacker impersonate any domain — billions of older devices and software installations may be vulnerable after round of fixes, patch yours immediately

  2. Mastodon — mastodon.social TIER_1 English(EN) · [email protected] ·

    Leaked private keys for eight CA certificates let any attacker impersonate any domain Leaked private keys for eight CA certificates let any attacker impersonate

    Leaked private keys for eight CA certificates let any attacker impersonate any domain Leaked private keys for eight CA certificates let any attacker impersonate any domain — billions of older devices and software installations may be vulnerable after round of fixes, patch yours i…

    LINKS tomshardware.com/…/leaked-private-keys-fo… tomshardware.com/tech-industry

RELATED ENTITIES

RELATED TOPICS