Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

The eMudhra CA key exposure involved eight intermediate certificates generated with weak private keys. Although the affected intermediates had not issued publicly trusted end-entity certificates, changes to certificate trust stores created a need to identify dependencies and plan certificate replacement across affected environments.

On October 19, 2026, we learned about eMudhra’s eight shockingly weak keys: where eMudhra was trusted to pick a 115-digit number for their virtual combination lock protecting the Internet, they picked the number 4. Not even four digits, just the number 4. The other seven keys were similarly weak: 56, 66, 115, 155, 156, 230 and 237. The next day, we wrote a blog post on the immediate action we took to mitigate this leak, and what customers needed to do on their end to stay secure.

Eight eMudhra intermediate certificate authority (CA) private keys were compromised after being generated with insufficient randomness. Attackers could use these keys to forge certificates and impersonate legitimate websites or services to clients that still trust them. An attacker able to intercept a connection could potentially read or modify sensitive traffic.

India’s largest bank confirmed a data loss incident in a 21 October 2026 filing with the BSE and NSE. The alert came five days earlier, on 16 October, through SBI’s threat intelligence channels, which its filing names alongside the Defence Cyber Agency, and from CERT-In. Both flagged suspected customer data on the dark web.

On October 17, 2026, a researcher reported that eight intermediate certificate authorities (CAs) run by eMudhra have private keys that anyone can calculate from the public certificates. Six of the CAs are for TLS (website) certificates and two are for code signing. Sectigo cross-signed the same eight keys, so 16 certificates are affected in total With these keys, anyone can issue a certificate for any website, or sign software, and it chains to root CAs that many systems trust.

Railway's security incident may have exposed decrypted customer environment variables. Pull and scan yours with GitGuardian to know what to rotate first.

Every year in the Data Breach Outlook, Kroll reviews its breach data to identify the hardest-hit industry and the trends shaping risk across sectors. Our analysis ran from June 2025 to June 2026 and found the most breached industry was financial services. This year, Kroll also examined how many individuals were affected by the breaches Kroll handled to better understand their overall scale.

Federal agencies are facing a critical reckoning with cybersecurity. In the past year alone, high-profile breaches have exposed millions of Americans’ personal data, compromised sensitive intelligence networks and revealed significant gaps in access control practices across some of the government’s most trusted institutions.

At JFrog’s swampUP 2026 conference in New York, security leaders gathered to tackle the rapidly evolving landscape of software supply chain security and AI-driven development. In this exclusive sit-down interview from the event, former SolarWinds CISO TIM (now CISO in Residence at Team8) sits with JFrog CISO Paul Davis and reflects on the historic 2020 Sunburst breach that reshaped the cybersecurity industry. This conversation has been edited for length and clarity.