eMudhra CA Intermediate Keys Found Weak; Browsers Blocked Them, Server Trust Stores Lag

·2 views

A researcher reported on October 17, 2026 that private keys for eight eMudhra intermediate certificate authorities had been compromised. Analysis showed the keys were tiny numbers rather than random 384-bit values, so they could be guessed almost instantly. eMudhra attributed the problem to a flaw during an April 2025 key ceremony and said root keys were unaffected and no certificate for a real site had been issued. Chrome and Firefox revoked the intermediates within hours, but operating system, Python, Java and vendored trust stores update only when their packages are rebuilt or upgraded. Security experts warn that businesses should check where their services source trusted certificate authorities and when those lists were last refreshed.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

How to Back Up Cyber Insurance Questionnaire Answers With Verifiable Evidence

A security consultant argues that cyber insurance questionnaire answers such as MFA coverage and EDR deployment should be backed by documented evidence rather than assumptions. The piece cites a 2022 case in which an insurer and a manufacturer agreed to rescind a policy after the insurer said MFA protected only the firewall, showing how unsupported answers can void coverage. It recommends using command-line exports and audits to find accounts lacking MFA, comparing EDR agents against asset inventories, checking email authentication records like DMARC, and keeping dated backup restore logs. The author suggests organizing evidence into dated folders starting about 90 days before policy renewal, and advises consulting a broker and coverage lawyer about rescission rules in one's state.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Why DMARC fails even when SPF and DKIM pass: the role of domain alignment

A common situation after moving a DMARC policy beyond p=none is a message where SPF and DKIM both pass yet DMARC still fails. DMARC requires that at least one of these checks passes for the same domain shown in the visible From: header, a requirement known as alignment. Relaxed alignment, the default, accepts subdomains that share the organisational domain, while strict mode demands an exact match. Third-party services such as invoicing tools, CRMs and newsletter platforms often sign with their own domains, which causes this failure, and enabling custom domain authentication with the vendor usually resolves it. Forwarding and DKIM selector or key rotation problems can also break alignment, so administrators should review DMARC aggregate reports regularly and ramp enforcement gradually.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Four Tests to Run Before Taking a Polymarket Trading Bot Live

A profitable backtest does not guarantee a trading bot will perform well in live markets, since flawed assumptions can inflate simulated results. The article recommends checking four areas, starting with whether the strategy relies only on information that was actually available at decision time, to avoid look-ahead bias. It also warns that historical prices may not reflect executable fills, so entry prices and order liquidity should be tested for sensitivity. Results should remain positive after accounting for fees and other trading costs, especially for strategies built on frequent small gains. Finally, the author advises validating the strategy on out-of-sample data kept separate from development to reduce the risk of overfitting.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

How to Calculate Average Order Value from Shopify Orders via the Admin GraphQL API

A developer explains how to compute average order value (AOV) from Shopify data by pulling orders through the Admin GraphQL API and calculating it in Node.js. The approach requires a custom app with an access token and the read_orders scope, which by default covers only the last 60 days of orders. The guide filters out test and cancelled orders and uses current price fields so refunds are already reflected in the totals. It reports two figures, one including shipping and taxes and one based on product subtotals alone. The post notes that the author works on a Shopify cart app, which is mentioned only at the end.

0 comments Read more at DEV Community