# Researcher finds forged eMudhra certificates accepted outside browsers

_Published Wednesday, October 21, 2026 at 6:03 AM EDT · Security · Latest · Tier 2 — Notable_

![Researcher finds forged eMudhra certificates accepted outside browsers — Primary](https://storage.ghost.io/c/ee/88/ee889f88-37ef-43e5-9180-f9b88ee6261d/content/images/size/w1200/2026/10/emudhra.png)

Security researcher Scott Helme reports that default configurations of curl, Python and Node accepted a forged certificate in local tests using compromised eMudhra certificate authority keys. His findings extend the exposure beyond browser certificate blocks already announced.

Helme recovered eight private keys from public certificates in less than a second. Each key used only a single byte of possible values, making recovery practical on a laptop. The affected authorities include six TLS issuers and two code-signing issuers.

Chrome and Firefox block the affected intermediates. Helme says many other clients do not check revocation or Certificate Transparency by default; exploiting their trust would require an attacker to reach the network path.

## Sources

- [scotthelme.co.uk](https://scotthelme.co.uk/eight-bits-of-trust-emudhras-ca-keys-cracked-in-milliseconds/)

---
Canonical: https://techandbusiness.org/newswire/uJmCQpfK_-2wEBRvNK-aev
Published: 2026-10-21T10:03:23.145Z
Story chronology: 2026-10-21T09:08:08.000Z
Retrieved: 2026-10-25T06:21:20.358Z
Publisher: Tech & Business (techandbusiness.org)