Post

Russ Cox
@swtch.com

The details are now public, as of two hours ago. bugzilla.mozilla.org/show_bug.cgi... The secret P-384 keys for these intermediate CAs are all zeros except the last 8 bits. All not-updated software can be MITM'ed now. IOT boxes that can't or don't update are now trivially MITM'able forever.

bugzilla.mozilla.org2083449 - Private key compromise of eMudhra Intermediate CertificatesNEW (nobody) in CA Program - CA Certificate Compliance. Last updated 2026-10-20.
Russ Cox@swtch.com

If you make HTTPS requests or have other TLS clients and care about MITM attacks, you need to update today. If you run Go: go get go@1.27.3 If you run Homebrew: brew update brew install ca-certificates If you run Linux, maybe stay off the internet for now.

135 reposts381 likes

VerdantOzark
@verdantozark.bsky.social

I saw another suggestion that these are "HSM handle keys" -- the idea is that you ask the HSM to encrypt with this mostly-zero key and it swaps it out for the real one

Colin McMillen
@mcmillen.dev

That said, "There are no entries in the certificate transparency logs for these intermediates in that period, indicating that CT-enforcing clients like Firefox, Chrome, Edge and Safari could not have been attacked." but random other internet-connected devices very well could have been.

void
@voidnil.bsky.social

> The secret P-384 keys for these intermediate CAs are all zeros except the last 8 bits. What a dumb reality/universe I was born to...

milo
@mtmilo.net

You have less chance rolling 2 consecutive nat-20s than you did guessing this key