4 real? Tracking exploitation and patching of eMudhra’s weak keys
Cloudflare reports that eMudhra's eight weak intermediate keys (derived from numbers like 4, 56, 66, 115, 155, 156, 230 and 237) could be recovered by anyone from public certificates, and that it patched all high-priority systems after learning of the issue on October 19, 2026. Logging on Pingora recorded about 22,000 attempted handshakes with the weak keys over a week, two-thirds of them fetches of test sites, with roughly 160 presenting forged certificates naming unrelated domains, one dated October 20 at 18:19 UTC, less than an hour after Mozilla's bug report became public. Probe data from 50 million challenge-page connections shows modern browsers mostly patched while bots and embedded browsers such as Android WebView lag, with more than half of probes on large networks still accepting the compromised chain.
Why it matters: Documents real-world exploitation evidence and patching progress for a CA key compromise, with concrete data on forged certificates and client-side trust.