The private key guarding a trusted certificate authority was the number 4

Not a 384-bit number beginning with a four. The number four. A researcher using the name Flupke published that private key on GitHub, because by then there was no secret left in it to protect.

Certificate authorities are the small set of organisations your browser trusts to vouch for websites. eMudhra is one of them, an Indian company whose root certificate ships inside Firefox, Chrome, Safari and Windows. During a key generation ceremony in April 2025 a faulty script produced a second batch of keys alongside the proper ones, every value below 256, recoverable by trying 256 numbers. The labels looked close enough to the real ones that staff picked the wrong batch. Eight intermediate certificates went out signed by keys a laptop could work out over lunch, and anyone holding one could have minted a valid-looking HTTPS certificate for any website they chose.

The clean-up was fast. Mozilla received the report at 20:06 UTC on 17 October and had Firefox users covered by 22:59 that same evening, through OneCRL, a revocation list that reaches browsers without an update. Chrome blocked the same day, Apple on the 19th, Microsoft on the 20th. There is no evidence anyone abused the keys, and most of the eight were never used in production, though the window had technically been open since April last year.

The automatic part protects you without asking. The rest does not: Firefox 158.0.1, the refreshed root stores, the patched runtimes underneath other software all arrive as ordinary updates, and a browser three versions behind gets none of them. Tendvane's app update check runs through winget and brings Chrome, Firefox and Edge up to current in one pass.