eMudhra intermediate CA compromise drives widespread trust store updates; MCUs likely spared

The disclosure on October 20, 2026 of a compromise at the certificate authority eMudhra has set off a rush of security updates across programming languages, operating system packages, developer tools, and essentially anything that opens a TLS connection. At the centre of the incident are eight intermediate CA certificates whose private keys could be reconstructed by anyone who cared to look.

What was compromised

According to a write-up by Daniel Mangum that surfaced on the Hacker News front page, the eight intermediates were generated with catastrophically weak P-384 private keys. In each case the top 376 bits of the key were zero, and one key was the integer 4. Because the keys were generated incorrectly rather than leaked in a separate breach, they can be recovered directly from the public certificates, which have existed since April 2025.

An attacker with moderate technical ability could therefore issue a leaf certificate for any domain, present it alongside a compromised intermediate, and be trusted by every client whose trust store included eMudhra's root. Mangum notes that this covered all the major root programs, making the forgery viable against a broad range of software.

Browsers were spared, other clients may not have been

Major browsers require a leaf certificate to appear in certificate transparency logs before trusting it. Mangum writes that there are no CT log entries for the compromised intermediates going back to their creation, which let browser vendors state with reasonable confidence that users of Firefox, Chrome, Edge and Safari were not attacked.

The same assurance does not extend to the rest of the ecosystem. Many clients outside the browser, including server-side TLS stacks, command-line tools and embedded software, do not enforce certificate transparency, so there is no way to know whether the weak keys were exploited against them during the window between April 2025 and the disclosure.

A broad but uneven patching effort

The now-public bug report from Mozilla and the surrounding analysis prompted maintainers to push updates that either filter the compromised intermediates or drop trust in the eMudhra root entirely. Mangum describes the response as reaching essentially everything involved in establishing TLS connections, and many users have likely noticed a flurry of updates as a result.

Why most microcontrollers escaped

Mangum's post gained attention as a counterpoint to some of the loudest warnings. Russ Cox warned on Bluesky that IoT devices which never receive updates could be permanently exposed to man-in-the-middle interception. Scott Helme, whose post Mangum notes sat at the top of Hacker News, warned that embedded and operational technology, from cameras and routers to cars, medical devices, payment terminals and industrial controllers, could be affected for years because their trust bundles are frozen until 2039.

Mangum's argument is that IoT covers very different classes of hardware. Single-board computers such as a Raspberry Pi, or anything running Linux, ship a full bundle of root certificates and depend on the same update channels as desktop systems; these devices should be patched over the air as soon as possible.

Microcontroller-class devices are a different case. With often less than 1 MB of non-volatile storage and no operating system vendor curating a trust store for them, MCU developers typically pin exactly the roots they need. Mangum points to an HTTP sample in the Zephyr RTOS that talks to google.com while shipping only a single root certificate. Unless a fleet specifically pinned eMudhra's root, the compromise simply never reaches it.

Why it matters

The incident exposes the gap between the browser ecosystem and everything else. Certificate transparency gave browsers verifiable evidence that they were not attacked; non-browser clients have no equivalent record, so the true extent of any abuse may never be known. It also shows how long a silent trust failure can persist, with weak keys in place for roughly a year and a half before anyone noticed. Finally, it is a concrete argument for minimal, pinned trust stores on constrained devices: the storage limits that once looked like a hardship insulated MCU fleets from a CA failure, while devices that cannot update their frozen bundles remain the hardest exposure to close.