# SZB-d875e13ba5: eMudhra revokes eight more intermediate CAs after October key compromise According to The Hacker News, eMudhra has revoked eight more intermediate certificate authorities that it had earlier said were unaffected by its October key compromise. - Type: Breach - Status: Confirmed - Vendor: eMudhra - Disclosed: 2026-11-11 12:00 UTC - Data taken: 195 records - Sources: 3 distinct - First seen by cve.now: 2026-11-11 12:08 UTC · Updated: 2026-11-11 21:45 UTC Written by a model from the sources below. Verify against them. ## Summary The company says the flaw was a single line in an in-house Python script, and the newly revoked CAs had their keys compromised by that script even though their keys were not weakened. ## What to do - Check whether your organization relies on certificates issued by eMudhra's intermediate CAs - Confirm the revocation status of any eMudhra-issued certificates you use - Replace certificates that chain to revoked eMudhra intermediate CAs - Watch eMudhra's advisories for further revocations - Watch eMudhra's advisories for the full investigation findings. ## Timeline - 2026-11-11 12:00 UTC: Made public by The Hacker News - 2026-11-11 12:08 UTC: First seen by cve.now - 2026-11-11 21:27 UTC: Confirmed by eMudhra. BleepingComputer: “In a new incident report published Tuesday, eMudhra said that both sets of certificates were affected by a custom Python script used to transfer private keys b…” ([source](https://www.bleepingcomputer.com/news/security/emudhra-revokes-8-more-ca-certificates-after-private-key-mishap/)) ## What was taken 195 records, per [The Hacker News](https://thehackernews.com/2026/11/emudhra-revokes-8-more-cas-it.html). ## Evidence (3 sources) - 2026-11-11 · Press · [The Hacker News](https://thehackernews.com/2026/11/emudhra-revokes-8-more-cas-it.html): “The in-house Python script behind eMudhra's October key compromise has now cost the company 8 more of its intermediate certificate authorities (CAs), even though it did not weaken their keys.” - 2026-11-11 · Social · [Bluesky](https://bsky.app/profile/lobsters-feed.bsky.social/post/3n22onhzs5423): “eMudhra Statement on Recent Certificate Security Incident” (+2 more: [Bluesky](https://bsky.app/profile/news.karthihegde.dev/post/3n22ojipbeh2j), [Bluesky](https://bsky.app/profile/cybernewsph.com/post/3n22wcj6tof24)) - 2026-11-11 · Press · [BleepingComputer](https://www.bleepingcomputer.com/news/security/emudhra-revokes-8-more-ca-certificates-after-private-key-mishap/): “Certificate authority eMudhra has revoked eight additional intermediate CA certificates after an investigation into its recent certificate security incident found improper handling of private keys during the certificate-generation process.” (+1 more: [BleepingComputer on Bluesky](https://bsky.app/profile/bleepingcomputer.com/post/3n22vjbd62y2a)) ## Corrections None so far. Something wrong on this page? Report an error: https://github.com/sazabi/cve.now/issues/new?title=Wrong%20fact%20on%20SZB-d875e13ba5&body=https%3A%2F%2Fcve.now%2FSZB-d875e13ba5%0A%0AWhat%20is%20wrong%2C%20and%20the%20source%20that%20shows%20it%3A%0A ## Questions about the eMudhra breach ### Was eMudhra breached? Yes. eMudhra says so: “In a new incident report published Tuesday, eMudhra said that both sets of certificates were affected by a custom Python script used to transfer private keys between hardware security modules (HSMs) in April 2025.” (BleepingComputer). Source: https://www.bleepingcomputer.com/news/security/emudhra-revokes-8-more-ca-certificates-after-private-key-mishap/ ### What data was exposed? 195 records. ### What should eMudhra customers do? Check whether your organization relies on certificates issued by eMudhra's intermediate CAs. Confirm the revocation status of any eMudhra-issued certificates you use. Replace certificates that chain to revoked eMudhra intermediate CAs. Watch eMudhra's advisories for further revocations. Watch eMudhra's advisories for the full investigation findings. ## Related - Started as early warning SZB-d875e13ba5, first seen 2026-11-11 12:08 UTC - Browse: [Breaches](https://cve.now/breaches.md) · [Early warnings](https://cve.now/early-warnings.md) --- Source: cve.now Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards. Page: https://cve.now/SZB-d875e13ba5 Site guide for agents: https://cve.now/llms.txt