National CERT Warns of Eight Compromised Security Keys That Could Enab

National CERT Warns of Eight Compromised Security Keys That Could Enable Fake Websites

Pakistan's National CERT alerts that eight compromised eMudhra security keys could let attackers forge digital certificates and impersonate sites, urging organizations to block them before Oct 27, 2026.

NationPulse Desk

Oct 26, 2026 · 2:38 PM 2 min read

Key takeaways

National CERT warned that eight eMudhra security keys are compromised, enabling fake digital certificates.

Six of the keys were used for TLS certificates and two for code signing.

Mozilla recovered the keys within hours after the issue was reported.

Organizations must block the compromised intermediates and replace affected certificates by October 27, 2026.

No public evidence of malicious exploitation had been confirmed at the time of the advisory.

Pakistan's National Cyber Emergency Response Team (National CERT) issued a critical warning on eight compromised security keys used by eMudhra's emSign service. The keys could let attackers forge digital certificates, impersonate legitimate websites and services, and possibly intercept encrypted traffic.

The advisory notes that six of the keys were employed for Transport Layer Security (TLS) certificates, while the remaining two verified software through code signing.

How the Security Flaw Works

National CERT said the private keys, generated with the ECDSA P-384 algorithm, suffered from insufficient randomness. Mozilla independently recovered the keys within hours of the report.

This defect could enable attackers to create counterfeit digital certificates for sites and services they do not own, allowing impersonation of websites, APIs and other online services.

Who Could Be at Risk?

Systems that continue to trust the compromised certificates may be exposed to man-in-the-middle attacks, where criminals could intercept, read or modify communications thought to be secure.

The advisory urged government departments, critical information infrastructure operators, financial institutions, businesses, software developers and device manufacturers to verify whether their systems are affected.

No Confirmed Attacks Reported

At the time of the advisory, no public evidence of malicious exploitation existed.

eMudhra said the affected intermediate certificate authorities had not issued legitimate certificates for end users. Google confirmed that no TLS certificates linked to the six compromised intermediates appeared in Certificate Transparency logs before the certificates were blocked.

National CERT warned that some applications and systems might stay vulnerable if they rely on their own certificate stores instead of browser updates.

What Organizations Must Do

National CERT instructed organizations to act immediately: install available security updates, refresh certificate trust stores, and block all eight compromised intermediate certificates, including cross-signed ones.

Administrators should also check software that may not receive protection via routine browser updates, such as Java keystores, Python certificate bundles, Node.js deployments, Go applications, containers, VPNs, security appliances and IoT devices.

Affected legitimate certificates must be replaced with ones issued under an unaffected trusted hierarchy before October 27, 2026.

Monitor for Suspicious Activity

The advisory told organizations to watch for unusual certificate chains, unexpected issuers, validation warnings and odd network redirections.

Relevant security logs should be preserved and remediation steps documented.

Incidents suspected of certificate forgery or interception should be reported through National CERT's official portal or emailed to cert@pkcert.gov.pk.

National CERT also cautioned against indiscriminate removal of root certificates, which could disrupt unrelated legitimate services, and advised specifically blocking the compromised intermediate certificates only.