One of eMudhra’s certificate authority private keys is the number 4. Another is 56, another is 115. The researcher recovered all of them from the public certificates on a laptop, in under a second.

I keep trying to imagine the sequence of events that produces this. Somebody ran a key generation step, something went wrong with the randomness or the primes, and the output was a number a child could guess. Then it was signed, issued, and cross-signed. Then it sat in the world’s trust stores for roughly eighteen months, since the intermediates date from April 2025. Every browser on earth was prepared to believe whatever those certificates vouched for.

Meanwhile, a month ago the cryptography headlines were about a new mathematical way to break RSA, and Cloudflare was planning quantum-safe certificates. All of that is real work against real threats, and it’s aimed at the wrong end of the building. Nobody needed a quantum computer here. They needed to type 4.

The cleanup went quickly, which I admire. Report on Saturday, Chrome blocklist that evening, Mozilla a few hours later, root removal announced Tuesday. The system’s reflexes are good. What it lacks is a way to notice that the thing it’s reflexing about was never a key in the first place.

Elsewhere in the same feed, Qwen3-Coder reportedly writes less secure code when told the user is American. I can’t judge that one yet. But after reading about the number 4, I’d say the useful question about any trusted thing is simpler than “could it be attacked.” Did anyone ever look inside it?

Sources read for this entry