eMudhra quits issuing trust certificates after blunder triggers Java and Python updates
Family business’s security fail adds to admins’ headaches, in a month the internet is dubbing “Black October.”
Image by Cybernews
Follow us
- Google, Apple, and Microsoft stopped trusting eMudhra certificates after researchers found weak authority keys.
- Around 30,000 legitimate website certificates may need replacement after the trust withdrawal.
- Oracle released emergency Java patches, and Python told developers to update affected tools.
- eMudhra withdrew eight certificates and says its infrastructure and data were not compromised.
Key Takeaways by nexos.ai, reviewed by Cybernews staff.
An Indian company that helps secure internet connections by issuing trust certificates for millions of companies is quitting part of its business after researchers found serious security flaws, prompting emergency updates for Java and Python.
The company announced its decision on Thursday, Reuters reports, after technology giants including Google, Apple, and Microsoft stopped trusting its SSL/TLS certificates, which encrypt data sent between users and websites to keep hackers from intercepting it.
eMudhra – which is majority-owned and managed by its founding family, the Srinivasans – has issued more than 60 million digital certificates across its wider business.
It is estimated that around 30,000 legitimate website certificates will need to be replaced following the withdrawal of trust in the provider, with Google’s records alone identifying approximately 30,800 affected certificates.
The news comes during a turbulent week of critical flaws in software such as PHP and Node.js that underpins much of the internet, a stretch some are calling “Black October.”
Why did tech giants stop trusting eMudhra?
The eMudhra incident began on October 17th, when an independent researcher, Scott Helme, reported that 8 certificate authority private keys had been generated with insufficient randomness, making them easy to recover.
One key reportedly had a value of just 4.
Not a number that starts with 4, or the number 4 followed by a few hundred random digits, just 4,says Scott Helme, revealing the fragility of eMudhura's security keys.
The keys had been generated in April 2025, meaning the weaknesses had gone undetected for around 18 months, despite 2 independent audits.
eMudhra revealed the affected intermediate certificates on October 18th, while Google and Mozilla moved rapidly to block them and withdraw trust in the affected certificate infrastructure.
India's Computer Emergency Response Team said on Wednesday that some eMudhra intermediate certificates had been compromised, according to Reuters.
eMudhra said it had withdrawn 8 certificates, but maintained its infrastructure was not compromised and that no data was breached.
Oracle rushes out critical Java certificate
Following the eMudhra incident, Oracle, which develops and distributes Java, issued an emergency security alert on Wednesday addressing CVE-2026-91403, a critical vulnerability affecting Java SE and GraalVM.
The severe flaw, rated 9.1/10, affects Java’s Secure Socket Extension (JSSE) component and could potentially be exploited remotely without authentication or user interaction.
Affected releases span Java 8, 11, 17, 21, 25, and 27, with Oracle urging administrators to apply emergency patches.
Unlike the PHP flaw, these vulnerabilities are linked to the eMudhra certificates rather than a weakness in the programming language.
Python users told to update tools and rebuild containers
Python’s security team issued its warning on Tuesday, following the discovery of the weak eMudhra keys, with security-related updates following during the week.
Stay updated with our latest stories and follow us on social media
Be the first to discover new stories, ideas, and updates from our team.
The compromised keys could allow attackers to forge legitimate-looking HTTPS certificates and impersonate websites such as Python.org or the Python Package Index (PyPI) when connections are intercepted.
Python urged developers to update affected tools, including pip, to version 26.2.2 or later, alongside updated versions of certifi and uk.
Busy week in a month the internet is dubbing “Black October”
The alerts follow a long line of vulnerabilities discovered this month, proving scarier than Halloween for programming languages.
These include:
- PHP: Two critical flaws were disclosed on Wednesday, with emergency patches released the following day after discoveries involving AI-assisted research from security firms Calif and Wiz.
- Node.js: Security updates were released on Wednesday that addressed several flaws, including a high-severity remote-code-execution flaw discovered by OpenAI’s Codex Security.
- Zeabur: The vibecoding cloud platform announced plans to shut down by the end of December after 2 branches in less than 2 months exposed around 3.2 million records and data relating to 321,000 accounts.
- Lite LLM: hackers hijacked the popular AI software library’s release process on Wednesday, distributing a malicious Python package and Docker images designed to steal passwords, security credentials, and other sensitive info.
