eMudhra shares fall after weak keys found in eight TLS certificates; MeitY forms probe team

Shares of Bengaluru-based digital trust company eMudhra Ltd fell sharply after researchers flagged weak private cryptographic keys linked to eight intermediate certificate authorities used in its global TLS certificate business (The Free Press Journal, Mathrubhumi). Google, Apple, Microsoft and Mozilla blocked or revoked trust in the affected certificates (Business Today, The Sentinel), CERT-In issued an advisory warning of website impersonation and fraudulent certificates (PSU Watch), and the Ministry of Electronics and Information Technology said on Wednesday that it had taken serious note of the matter and constituted a special team to investigate (The Economic Times, The New Indian Express).

What every report agrees on

All reports describe the same sequence: private keys tied to eight of eMudhra's global TLS intermediate certificates were weak enough to be reconstructed, with The Sentinel and Mathrubhumi tracing the failure to a key generation event in April 2025 (The Sentinel, Mathrubhumi). Mint says the incident came to light on October 17, 2026, with Cloudflare confirming two days later that the keys posed a serious risk (Mint), while The Hindu dates public emergence to October 20 (The Hindu). Major browser and platform makers blocked the certificates (Business Today, The Sentinel, Mint), CERT-In warned of fake websites and cyber fraud (PSU Watch), eMudhra acknowledged the flaw and said it was working with potentially affected customers on replacement certificates (The Times of India), and the stock fell about 20% in a session to ₹432 on the NSE (The Free Press Journal, Mathrubhumi). MeitY said the incident pertained to the global certificate business, that impact on Indian websites was very limited, and that Digital Signature Certificate and eSign services regulated by the CCA were unaffected (The Economic Times, The New Indian Express).

How the left-leaning press told it

The New Indian Express, Hindustan Times, The Hindu, The Hindu and Deccan Herald: Trust breach and official probe

Centre-left outlets carried both readings. The New Indian Express led on the government response, reporting MeitY's special team, its statement that Indian impact was very limited and its criticism of social media accounts for fear-mongering (The New Indian Express). Hindustan Times placed the episode among recent major cybersecurity incidents linked to India and said the flaw put global web security at risk, prompting emergency action by browser makers (Hindustan Times), while The Hindu's explainers set out how the exposed keys affect internet users and noted eMudhra's services are used across government and public sector bodies (The Hindu, The Hindu). Deccan Herald described the lapse as issuing dangerously weak keys that put large numbers of users at risk of website impersonation before browsers blocked them (Deccan Herald).

How the right-leaning press told it

The Times of India, The Economic Times and OpIndia: Ministry says impact limited

The Times of India explained how a single flaw in a key generation ceremony left the global TLS certificates vulnerable and reported eMudhra's acknowledgement and replacement effort (The Times of India). The Economic Times led on the IT ministry, reporting the special team, the finding that impact on Indian websites was very limited and the ministry's reference to fear-mongering on social media (The Economic Times). OpIndia, rated right, foregrounded MeitY's clarification that effects on Indian websites and applications were minimal and transient, alongside an account of the issue that drew responses from Google and Apple (OpIndia).

How the centre told it

Mint: Browsers block weak certificates

Mint reported that Google, Apple and Mozilla blocked the eight certificates after researchers found private keys weak enough to allow attackers to impersonate websites (Mint). It gave a timeline, dating discovery to October 17, 2026 and Cloudflare's confirmation to October 19, and framed the risk to internet users as serious (Mint).

The coverage of this story does not divide along left and right lines.

What the record shows

The record the reports cite consists of browser and platform actions, a CERT-In advisory, MeitY statements and eMudhra's own acknowledgement. Google, Apple, Microsoft and Mozilla blocked or revoked trust in the affected intermediate certificate authorities (Business Today, The Sentinel), and CERT-In warned of potential website impersonation, fraudulent certificates and cyberattacks (PSU Watch). MeitY said the matter concerned the global certificate business, that the effect on Indian websites and applications was very limited and transient, that CCA-regulated DSC and eSign services were unaffected, and that some social media accounts were engaged in fear-mongering (The Economic Times, The New Indian Express, OpIndia). What the reports do not settle is severity in practice: outlets such as The Sentinel describe a historic trust crisis arising from single-byte private keys (The Sentinel), Mint and Deccan Herald describe a serious risk of impersonation (Mint, Deccan Herald), and no report in this set documents a confirmed instance of exploitation. The market impact is uncontested in the reports available here, which record a 20% single-session fall to ₹432 (The Free Press Journal, Mathrubhumi).

Drafted by the Alethman engine from 14 independent reports, and checked by an editor before publication. An outlet's side comes from published media-bias ratings (Media Bias/Fact Check, AllSides) or documented ownership, named under the coverage bar; Alethman does not rate outlets itself.