On October 17, 2026, a security researcher found that the private keys behind eight intermediate certificate authority (CA) certificates from eMudhra could be recovered in milliseconds. Anyone holding those keys could issue certificates for any website that browsers and apps would trust as real.