Here's what's happening with compromised TLS certificates right now. Eight intermediate certificates issued by India-based certificate authority eMudhra were found to have private keys so weak that anyone could recover them almost instantly. Anyone holding those keys could issue fake certificates trusted by browsers, which would let them impersonate websites and read or change encrypted traffic in a man-in-the-middle position.
Browser makers have responded. By late Tuesday, October 20, Mozilla, Google Chrome and Apple had blocked all eight intermediates, and Mozilla released Firefox updates that day for users whose settings had blocked the automatic revocation. Certificate Transparency logs, which record browser-trusted certificates, showed no sign that the compromised keys had been used maliciously.
The harder part is everything else. Linux distributions, embedded systems and Internet of Things devices carry their own trust stores, and some of those are still waiting on updates. Red Hat's advisory (CVE-2026-111943) says systems are at risk if their ca-certificates package still trusts the affected intermediates, and you can check that with the command below.
rpm -q ca-certificatesFor most people the practical step is to keep browsers and operating systems fully updated. Software that doesn't check certificate revocation may keep trusting the bad certificates until it's patched, so a device that rarely gets updates is the one to worry about.
🕒 As of October 2026
