The Internet goes on high alert after discovery of 8 compromised TLS certs
The gist
A researcher reported eight compromised eMudhra intermediate CA keys; Chrome blocked six within about 100 minutes.
Revocation alone doesn't protect every app, so some clients need separate updates.
How it unfolded
- Oct 17, 2026A researcher identifying themselves only as Wayne reported the compromise of eight eMudhra intermediate CA private keys to root program teams, demonstrating access by signing the message "We have a problem here - Wayne" with each key.
- Oct 17, 2026Chrome received the report at 18:05 UTC and pushed a CRLSet (a browser blocklist) update blocking all six TLS keys by 19:45 UTC.
- Oct 17, 2026Mozilla received the report at 20:06 UTC and completed its OneCRL blocklist rollout by 22:59 UTC, in under three hours.