Everyone pointing at eMudhra and freaking out about how they got their hands on global internet security should have a look at the list of root CAs currently installed on your OS or your browser. Each and every one on it can do the same thing.
TL;DR - WebPKI and code signing depend on a system where the entire world is dependent on any of these organisations not having a bad day. There are ways to mitigate, but they are mostly ignored because they would be detrimental to the current ecosystem.
By the way, enterprise "security" is no better. Products like Zscaler typically add their own root CA to managed devices, so they can intercept and inspect any encrypted device traffic by faking to be the remote side. It's a trade off that sacrifices someone else's security.
Now, of course the vendors maintain stringent standards for who gets on those lists. Typically they require current security certifications and audits. EMudhra has shown that this is all "trust me bro" levels.
Long story short: each vendor decides their own trusted list; 150 for Google, 175 for Apple,250+ for Microsoft. The association of Colombian notaries, the Spanish police, Amazon, the Taiwanese government to name but a few. Each trusted implicitly and invisibly.
Swisskey eventually disappeared from the shipped CA lists without much fanfare. Dutch root CA Diginotar got hacked in 2011, printed fake certificates for Google and got taken under government control before declaring bankruptcy.
This is not a new thing. Two decades ago I used the root CA of Swisskey as an example: their certificate was still being bundled everywhere despite the company having gone under a year before.
Turn on the slow whoop and prepare for incoming emergency OS patches. And when we're done cleaning up maybe have a real conversation about evolving from the current mess of trusted roots.
The private keys of eight eMudhra intermediate CA certificates have been compromised.
They chain to roots trusted by the Mozilla, Microsoft, Apple and Chrome root programs and by many downstream trust stores.
emudhra.we-have-a-problem.co…
So can we finally talk about how the Yandex sites probably just host the C2 nodes and not the actual bots? And that the "super" computers in those sites have bugger all to do with it?
Remco van Mook retweeted
If I end up having to write a blog entry explaining that a computer program is not a person, I'm going to be very upset
I still find it incredible that somehow we're led to believe we have this incredible world changing technology, but the only stable shape we seem to be able to ship it in looks like a 1990s IRC chat client.
Remco van Mook retweeted
There’s a SIGNIFICANT token cost associated with their hacking rampage.
They’ve spent millions of dollars attacking other orgs. They are liable and negligent.
Attacker economics has always been a part of cybersecurity, and this is the equivalent of a nation state with unlimited budget doing friendly fire.
SCOOP: OpenAI, Anthropic and security researchers are investigating tens of thousands of incidents - not dozens - in which their frontier models took steps that outside evaluators would consider problematic, sources told Axios.
The sheer volume of incidents found in our reporting indicate that the problem is orders of magnitude more complex than what is currently publicly known and disclosed.
The findings also raise questions about what level of control anyone working on AI development can expect to have over their own technology, and whether these kinds of incidents are becoming synonymous with frontier deployment.
Read my latest for Axios here: axios.com/2026/09/26/openai-…
