When Trust Breaks: What 8 Compromised TLS Certificates Mean for Your Enterprise

On October 17, 2026, a researcher reported that the private keys behind eight intermediate certificates from eMudhra, an Indian certificate authority (CA), were so weak they could be recovered on a laptop in under a second (Scott Helme). The internet had found out that eight of its trusted ID-issuers had been handing out IDs with locks anyone could pick. Whoever holds those keys can mint a valid-looking certificate for any website: your bank, your cloud provider, your payroll vendor. Google, Mozilla, Apple and Microsoft moved fast to block the certificates in their browsers and operating systems within days (The Hacker News). Ars Technica called it the internet going “on high alert.” The browser fix is the good news. The harder question for every enterprise is what…