THE INTERNET GOES ON HIGH ALERT AFTER DISCOVERY OF 8 COMPROMISED TLS CERTS

Summary from the TLDR InfoSec newsletter

Eight eMudhra intermediate TLS certificates had private keys of only 3 to 8 bits, allowing anyone who recovered them to sign browser-trusted certificates for arbitrary servers. Browsers, several apps, and programming languages have blocked the certificates. VPN users face the immediate risk from active man-in-the-middle attacks. Updating Linux distributions, embedded systems, IoT devices, and bundled trust stores remains a long remediation effort.