Overview
- The issue was reported to root‑store programs on October 17, and Chrome and Firefox pushed blocks within hours while Apple, Microsoft and several major projects followed between October 19 and October 20.
- Researchers recovered the eight private keys in under a second because each key was generated as a single‑byte number (4, 56, 66, 115, 155, 156, 230 and 237) instead of a 384‑bit random value.
- Vendors responded by revoking the affected intermediates, removing the emSign ECC Root CA - G3 from some bundles, and releasing patches; Chrome plans a staged removal of that root starting October 27.
- eMudhra says the problem is limited to those eight intermediates, that its root keys and most domestic eSign/DSC services are unaffected, and that an internal and third‑party investigation is ongoing.
- Significant residual risk remains for apps, language runtimes, package managers and embedded devices that do not receive revocation lists or update their trust bundles, so operators must update software and replace any impacted certificates to avoid forgery or service outages.