eMudhra Revokes Eight More Intermediate CAs After Python Script Exposes RSA Keys During HSM Transfer

eMudhra has revoked eight additional intermediate certificate authorities after discovering that a custom Python script exposed their RSA private keys in memory during a key ceremony. The company previously declared these CAs unaffected by the October key compromise incident. The script retrieved keys from Utimaco HSMs for transfer to Crypto4A devices but failed to demonstrate compliance with the company's CPS rules on key handling. Six of the revoked CAs were used for TLS certificates and two for code signing, affecting 195 certificates including those for universities and government entities. The incident originated from an April 2025 key ceremony where the same flawed script was used. Browsers including Microsoft, Apple, Chrome, and Firefox are accelerating the removal of trust in eMudhra's remaining roots as the company exits the public TLS market.

The Hacker NewsNovember 11, 2026Translated from English

Read at source

eMudhra has revoked eight additional intermediate certificate authorities after a detailed review revealed that its custom Python script exposed their RSA private keys in the memory of a ceremony computer.

The company had initially stated on Mozilla's bug tracker that these CAs were unaffected by the October key compromise. However, further analysis showed that the script retrieved the RSA keys from Utimaco HSMs during a transfer process to Crypto4A HSMs, preventing the company from proving compliance with its own CPS §6.2.6 rules on key material handling.

Of the eight newly revoked CAs, six were intended for website TLS certificates and two for code signing. The company placed four of them into production in May 2025. The list of affected certificates includes 195 entries, 29 of which belong to eMudhra's own domains, with the remainder covering universities, colleges, a county government, and other organizations.

Both the original ECDSA key weakness and the RSA key exposure trace back to an April 30, 2025 key ceremony. During this event, 16 CA keys were generated on Utimaco HSMs and a Python script was written to wrap and unwrap keys for transport between different HSM vendors. The script read private keys into the ceremony computer's memory, and while it did not truncate the RSA keys, it left their private components exposed.

The company chose the revocation reason code cessationOfOperation rather than keyCompromise for these eight CAs. Participants in the Mozilla bug thread have questioned this choice. All certificate holders have been migrated to new certificates, and eMudhra is exiting the publicly trusted TLS business.

Microsoft will begin removing the remaining ten eMudhra roots on November 16, while Apple will end trust in all G1 certificates by November 30. Chrome and Firefox will stop trusting G1 certificates issued after November 16.

Apple Mozilla KPMG eMudhra emSign Utimaco Crypto4A

ShareX Facebook LinkedIn Reddit

Meridian digestThe week's most consequential security stories, distilled into one briefing.See the digest

More in Vulns & Exploits

Vulns & Exploits

N-able Releases Hotfixes for Multiple Zero-Day Vulnerabilities in N-central RMM Platform

N-able has issued security hotfixes addressing several zero-day vulnerabilities in its N-central remote monitoring and management platform. The flaws were publicly disclosed by researcher Sean Bales, who published proof-of-concept exploits after alleging prior reports went unaddressed. As a precaution, the company took all hosted N-central environments offline across the Americas, Europe, and Asia-Pacific regions. The patches cover critical issues including remote code execution, XXE injection, OGNL injection, stored XSS, and local privilege escalation. Threat intelligence firm Defused reported active scanning and exploitation attempts against exposed servers, while Shadowserver noted a sharp drop in publicly reachable instances. On-premises customers are strongly urged to upgrade immediately following detailed guidance before restoring access.

BleepingComputerNov 11, 2026Translated from English

Vulns & Exploits

Fortinet Issues 89 Advisories Fixing Nearly 100 Vulnerabilities Across Products

Fortinet released 89 security advisories addressing nearly 100 vulnerabilities in its product lineup. The update follows the company's recent integration of frontier AI models into its security testing processes. Seventeen of the flaws are rated critical, with several enabling arbitrary code execution, authentication bypass, and other high-impact attacks. FortiMail received the largest share of critical fixes, followed by FortiAuthenticator, FortiOS, FortiManager, and FortiAnalyzer. A notable FortiClient issue named Fortinet2Shell stems from a CORS misconfiguration that allows arbitrary code execution when FortiPAM is enabled. Nearly 80 additional high-severity vulnerabilities were also resolved, covering XSS, code injection, privilege escalation, and denial-of-service conditions.

SecurityWeekNov 11, 2026Translated from English

Vulns & Exploits

Microsoft Resolves USB Audio Failures Introduced by September 2026 Security Updates

Microsoft has confirmed that the November 2026 cumulative updates fix USB audio problems that began appearing after the September 2026 Patch Tuesday releases. The issues affected USB Audio Class 1.0 devices on both client systems running Windows 10 and Windows 11 as well as server platforms starting with Windows Server 2012. Symptoms included devices failing to start, Code 10 errors in Device Manager, unresponsive volume controls, and loss of multichannel features such as 3D audio or 8-channel output. Microsoft previously issued out-of-band fixes on September 14 for the multichannel-specific problems and has now addressed the remaining cases in the November security updates. Users who cannot install the updates immediately can mitigate the problem by switching affected devices to 2-channel mode. The company also resolved separate Outlook sign-in and mail delivery issues on Exchange Server systems caused by the October 2026 updates.

BleepingComputerNov 11, 2026Translated from English