4 real? Tracking exploitation and patching of eMudhra’s weak keys

This incident shows how a single certificate authority weakness can become an enterprise-wide trust and availability risk: eMudhra’s weak keys were recoverable by anyone, enabling forged certificates that could undermine TLS security across customers, partners, and internal systems. Cloudflare’s rapid patching and logging found widespread attempts to use the weak keys, plus some forged certificates issued almost immediately after disclosure, underscoring the need for IT teams to treat PKI trust as a high-priority operational control and to verify that clients, proxies, and security tooling no longer accept the vulnerable intermediates.