eMudhra's private keys leaked, letting attackers impersonate any website
EMudhra Intermediate CA Compromise
The private keys for eight eMudhra intermediate CA certificates have been compromised, chaining to roots trusted by Mozilla, Microsoft, Apple, Chrome, and many downstream stores. Reporter Wayne signed a message with each key on October 17 to prove the breach. Browsers and OSes have blocked the certificates, and patched versions of Go, Electron, Python certifi, Rust webpki-roots, Homebrew, and NSS are available, but many clients still trust the intermediates.
An attacker with the private key of any of the compromised intermediate CAs could impersonate any website or service.