Eight eMudhra intermediate certificates compromised with weak keys—impersonation now possible for hosted sites
My Take
What happened Eight intermediate SSL certificates issued by Indian certification authority eMudhra have been compromised due to weak key generation, allowing attackers to forge certificates and impersonate any website signed by those intermediates.
Why it matters to hosts If your customers' sites were signed by an eMudhra intermediate, their HTTPS connections are breakable right now—attackers can intercept and forge traffic even though browsers have revoked the certs, because older clients and non-browser applications won't know to reject them.
What to do Audit which of your hosted sites use eMudhra certificates, notify those customers immediately, and work with them to reissue under a trusted CA—don't wait for automated revocation to propagate everywhere.
My view This is a hard reminder that certificate trust is only as strong as the weakest link in issuance. eMudhra's weak key generation isn't a new vulnerability class—it's a failure of operational rigor at a trust root, and it punishes every hosting provider and site owner downstream. The fix isn't technical; it's organizational and reputational.
How do you currently track which CAs issued certificates for your customers' domains, and do you have a process to notify them if a CA is compromised?
Key Themes
Notable Players
Eight intermediate SSL certificates compromised due to weak key generation; impersonation now possible for signed sites
London data center zone (europe-west2-b) experienced power event; disrupted services for Lloyds, HSBC, Royal Mail, Revolut
Announcing emergency patches for CVE-2026-109618 and CVE-2026-109619 with critical CVSS scores; patches deploying October 21 at 14:00 UTC
Deploying mitigations for eMudhra certificate compromise; collaborated on tsrs Rust port of TypeScript for 8x speed and 70% lower memory use
Retook control of Automattic after 33-hour paid leave; board members who placed him on leave have been removed
Top Stories
Eight eMudhra intermediate SSL certificates with weak keys are now publicly compromised, enabling attackers to forge TLS certificates for any site signed by those intermediates. Hosted sites relying on these CAs need immediate reissuance under trusted authorities, and non-browser clients may not recognize the revocation.
PHP is deploying emergency patches for CVE-2026-109618 and CVE-2026-109619 on October 21 at 14:00 UTC, both carrying critical CVSS scores. Any hosting provider running PHP applications needs to apply these patches immediately to prevent remote code execution.
Google Cloud's London zone (europe-west2-b) went offline due to a power event, disrupting banking, shipping, and property sites. Hosting customers relying on this region experienced service interruption with no immediate workarounds available.
Matt Mullenweg regained control of Automattic after a 33-hour paid leave period; the three board directors who placed him on leave have been removed. The move signals a major shift in governance and strategic direction for the WordPress ecosystem owner.
WordPress 7.2 beta is now available for testing on non-production environments. Hosting providers managing WordPress customer sites should begin testing compatibility and planning upgrade strategies.
Security & Compliance
eMudhra's private key compromise is not just a technical failure but represents a breakdown in certificate authority operational security. The weak key generation means attackers can impersonate any website or service signed by those compromised intermediates.
Eight eMudhra SSL intermediate certificates are publicly leaked; while browsers have revoked them, non-browser clients and older systems may continue to trust connections signed by these compromised intermediates. Hosting providers must proactively notify and assist customers.
curl maintainers are overwhelmed and shifting to public disclosure of lower-severity flaws starting October 26 to distribute the workload. Hosting providers using curl in applications should monitor for these public disclosures and plan patching cycles accordingly.
Palo Alto's firewall OS has been targeted by multiple ransomware groups for months; Unit 42 is investigating network compromises across numerous industries. Hosting infrastructure using Palo Alto firewalls should audit their security posture and patch status.
Open-source infrastructure projects remain critically underfunded and understaffed, creating a persistent supply-chain vulnerability. Hosting providers depending on projects like curl, OpenSSL, and others should consider funding contributions or risk supporting unmaintained security foundations.
Cloud & Infrastructure
Cloudflare's network signals helped OpenAI index hundreds of millions of additional pages for ChatGPT search. This integration can drive additional traffic to hosted customer sites if they are indexed and ranked by ChatGPT's search feature.
Acquisitions & Market
South Korean data center firm Elice's failed IPO signals cooling investor appetite for data center plays despite the AI boom. Hosting and data center firms seeking growth capital should expect tighter scrutiny and higher hurdles from public markets.
Your.Online, the Dutch hosting group behind 60+ acquisitions, is now backing Invicta Trust, a new trust services company built from the ground up. This marks a strategic shift toward organic development of complementary services alongside traditional M&A.
Control Panels & Technology
Cloudflare's tsrs Rust port of TypeScript achieves 8x speed improvement and 70% lower memory consumption. Hosting infrastructure using TypeScript tooling could benefit from migrating to tsrs for reduced resource overhead and faster build times.
openEuler desktop edition combines CentOS roots with homegrown containers and AI tools for enterprise Linux hosting. Hosting providers targeting Chinese markets or enterprise customers may need to add openEuler support to their server offerings.
Omnivore is now available as a fully self-hosted open-source read-later application after its cloud version shut down. Hosting providers can package Omnivore as a managed service or assist customers in self-hosting it.
Data Centers & Energy
Google Cloud's europe-west2-b zone went offline, disrupting Lloyds, HSBC, Royal Mail, and Revolut with no immediate recovery window or workarounds. Customers of cloud hosting providers should diversify across multiple regions to mitigate single-zone outages.
Front-of-the-meter power systems could help data centers reduce grid strain and expand capacity while addressing energy demand concerns. Hosting providers investing in new data center facilities should evaluate FTM power strategies to improve sustainability and operational resilience.
The U.S. government is funding the restart of nuclear reactors to supply power to AI data centers, with 2.25 GW currently available from refurbished plants. Hosting providers offering AI infrastructure should consider long-term partnerships with facilities backed by stable, large-scale nuclear power.
Domains & DNS
Domain registrants using fake identities to host pirate content have prompted publishers to call for better verification; ICANN is developing new registration verification policies. Hosting providers should prepare for stricter domain registrant vetting and potential liability for customers operating under false identities.
Community & Events
CloudFest Open Web Summit 2027 is scheduled for March 15, 2027, as a focused one-day event for hosting and web infrastructure professionals. Hosting operators looking to network and stay current with industry trends should mark this date and plan attendance.
Other News
Meta's Prometheus supercluster has tens of thousands of idle Nvidia GPUs; the facility is designed to keep a million GPUs running to train large models. Hosting providers building AI infrastructure should study Meta's approach to GPU utilization and redundancy planning.
A comparison of 10 AI agents tested on the Qwen3.5-4B local language model evaluates performance and configuration options. Hosting providers offering self-hosted LLM services can use this testing methodology to guide customer deployments.
Tencent, Alibaba, and ByteDance have ordered $35 billion in Nvidia RTX Pro 5500 GPUs; demand far exceeds Nvidia's production capacity with only 10 percent of orders expected to be fulfilled. GPU shortages will persist as cloud and AI hosting demand outpaces supply.
Nvidia's Vera CPU shows 2x throughput over Intel and AMD for AI agent workloads according to Modal's testing. Hosting providers building AI infrastructure should evaluate Vera CPUs as they become available for next-generation performance gains.
HPE's Spaceborne Computer 4 with mystery silicon and mirrored SSDs will launch to the Moon before year-end aboard Astrolab's FLIP rover. This represents edge computing at its most extreme and demonstrates HPE's commitment to rugged, remote deployments.
Immich and Paperless-ngx have both reached version 3.3.3, marking synchronized release milestones. Hosting providers offering self-hosted storage and document management services should update these applications and notify customers.
A storage device showing 16 unrecoverable sectors highlights ongoing data integrity risks even when SMART monitoring reports health. Hosting providers managing customer storage should implement regular extended checks and redundancy strategies.
JSOPanel is offering reseller hosting packages at $9.99/month across multiple regions. Competitive reseller hosting pricing continues to pressure margins for independent hosting providers.
GoDaddy offers guidance on building gaming websites for esports teams, streamers, indie game developers, and LAN centers. Hosting providers can use this content model to build educational resources and attract gaming-focused customer segments. --- #HostSecure