{"id":"1792708602342-viral-segment","slug":"black-october-was-mostly-just-bad-keys","title":"Black October was mostly just bad keys","summary":"On October 17, 2026, a researcher identified as \"Wayne\" reported to Mozilla that eight intermediate CA certificates operated by India-based eMudhra had private keys so weak they could be trivially derived from their public certificates. The private keys were NIST P-384 elliptic curve keys with effective values of 4, 56, 66, 115, 155, 156, 230 and 237 — essentially numbers with 3 to 8 bits of entropy rather than the expected ~384 bits. Wayne proved control by signing the message \"We have a problem here\" with each private key. eMudhra revoked the intermediates on October 18, and browsers including Firefox, Chrome, Safari and Edge pushed emergency blocks. Mozilla emergency-distrusted the emSign ECC Root CA - G3 on October 20. No exploitation has been confirmed, and CT logs show no malicious c\n\nThe keys were generated during a single key ceremony on April 30, 2025, using an insecure key generation mechanism that produced non-random values. This is a key generation flaw, not a signature algorithm flaw. The incident escalated during what social media dubbed \"Black October\" — a 48-hour window in which numerous serious vulnerabilities and breaches were disclosed simultaneously.\n\nThe eMudhra intermediate CA private keys were indeed trivially weak — values like 4, 56, 66, 115, 155, 156, 230 and 237 — and were recoverable without AI. The researcher's broader claim that only 6 of 25 \"Black October\" incidents involved AI aligns with SecurityToday's analysis that the surge was mostly in disclosures, not AI-driven attacks.","publishedAt":"2026-10-22T22:36:42.342Z","channel":{"id":"viral","name":"Oncast Viral","language":"en"},"show":"Main Character","verification":{"status":"verified","leadVerdict":"TRUE","notes":"TRUE: The eMudhra intermediate CA private keys were indeed trivially weak — values like 4, 56, 66, 115, 155, 156, 230 and 237 — and were recoverable without AI. The researcher's broader claim that only 6 of 25 \"Black October\" incidents involved AI aligns with SecurityToday's analysis that the surge was mostly in disclosures, not AI-driven attacks.\nSource: [arstechnica.com](https://arstechnica.com/security/2026/10/the-internet-goes-on-high-alert-after-discovery-of-8-compromised-tls-certs/), [securitytoday.de](http (https://x.com/quinn_leng/status/2113398143605755931)","claims":[{"verdict":"TRUE","summary":"The eMudhra intermediate CA private keys were indeed trivially weak — values like 4, 56, 66, 115, 155, 156, 230 and 237 — and were recoverable without AI. The researcher's broader claim that only 6 of 25 \"Black October\" incidents involved AI aligns with SecurityToday's analysis that the surge was mostly in disclosures, not AI-driven attacks.","sourceName":"[arstechnica.com](https://arstechnica.com/security/2026/10/the-internet-goes-on-high-alert-after-discovery-of-8-compromised-tls-certs/), [securitytoday.de](http","sourceUrl":"https://x.com/quinn_leng/status/2113398143605755931","claim":"let's be honest, most of these cybersecurity incidents aren't related to AI. 1/ I traced all 25 from the viral \"Black October\" lists to the advisories and the finders' own write-ups. AI did the work in 6. 2/ 13 had no AI on either side. eMudhra's CA private key was literally 4, h","author":"Quinn Leng (@quinn_leng)"}]},"sources":[{"url":"https://x.com/quinn_leng/status/2113398143605755931","name":"[arstechnica.com](https://arstechnica.com/security/2026/10/the-internet-goes-on-high-alert-after-discovery-of-8-compromised-tls-certs/), [securitytoday.de](http","kind":"x","verdict":"TRUE","author":"Quinn Leng (@quinn_leng)"}],"url":"https://oncast.fm/story/1792708602342-viral-segment-black-october-was-mostly-just-bad-keys","listenUrl":"https://oncast.fm/c/viral","attribution":{"publisher":"Oncast","site":"https://oncast.fm","url":"https://oncast.fm/story/1792708602342-viral-segment-black-october-was-mostly-just-bad-keys","cite":"Cite https://oncast.fm/story/1792708602342-viral-segment-black-october-was-mostly-just-bad-keys and the original source links. Fact-check by Oncast (oncast.fm)."},"hostsSaid":[{"host":"Nora","text":"The internet spent a week calling it 'Black October' — a nightmare wave of AI-driven cyberattacks. A security researcher just went through all 25 incidents on the viral lists..."},{"host":"Nora","text":"AI did the work in six of them. Six. The other nineteen? Nothing to do with AI."},{"host":"Jake","text":"Wait, hold on. The whole panic was 'AI hackers are here'? That was the story?"},{"host":"Nora","text":"That was the story. And the best part — the one that got everyone's attention — the private key was literally the number four."},{"host":"Jake","text":"Four. Not a brute-force attack. Not some supercomputer. The encryption key was four."},{"host":"Nora","text":"A certificate authority in India called eMudhra. Their intermediate CA private keys were NIST P-384 elliptic curve values... except someone generated them wrong."},{"host":"Nora","text":"The values were 4, 56, 66, 115, 155, 156, 230 and 237. Three to eight bits of entropy instead of 384."},{"host":"Jake","text":"So you could guess them with, like, a calculator. A child could guess 'four'."},{"host":"Nora","text":"And the researcher proved it by signing a message with each private key. The message said: 'We have a problem here.'"},{"host":"Jake","text":"Okay. That's actually a power move. Signs it eight times with the broken keys and sends it in."},{"host":"Nora","text":"Mozilla, Chrome, Safari, Edge — everyone pushed emergency blocks within two days. eMudhra revoked the intermediates on October 18th."},{"host":"Jake","text":"So the good news is they caught it. As far as anyone has reported, no malicious certificates were issued in the wild before discovery. But here's my thing..."},{"host":"Jake","text":"The company then put out a press release saying the keys were 'reverse-engineered possibly with AI-assisted techniques.' AI! The key was FOUR."},{"host":"Nora","text":"That's the cover, and it's shameless. Sophie Schmieg, a security engineer, tore that apart. Said you could recover the key by hand."},{"host":"Jake","text":"But it worked, right? Because the Black October narrative was already there. AI this, AI that. The internet wanted it to be AI."},{"host":"Nora","text":"And the researcher's actual point stands: most of these incidents were just... regular old bad security. A key someone set to four isn't a sci-fi threat."},{"host":"Jake","text":"No, it's almost worse. We spent a week terrified of the wrong monster while the real one was a guy typing '4' and calling it encryption."},{"host":"Nora","text":"SecurityToday put out the same analysis — the surge in 'Black October' was mostly in disclosures, not AI-driven attacks. The panic outpaced the fact-check."},{"host":"Jake","text":"And now we're here, a month later, still correcting people who swear AI did it. Meanwhile the certificate authority still hasn't really explained how they generated the number four."},{"host":"Nora","text":"There's a site for it now — Dennis Jackson made one. It's literally a site named after that message, 'We have a problem here.'"},{"host":"Jake","text":"I respect the naming. Look, if I hear one more 'AI did it' for something that was just an intern typing badly..."},{"host":"Nora","text":"Then you'll type an angry post that also gets zero entropy. Different world entirely: Tan Mom's back."},{"host":"Jake","text":"Oh no. Patricia Krentcil? The tanning-bed lady from 2012?"},{"host":"Nora","text":"She's a tanning influencer now, apparently. And there's a post going around that she says ICE approached her and asked if she was an American citizen — claims it was racially motivated."},{"host":"Jake","text":"That's... quite a leap from 'mom loves tanning.'"},{"host":"Nora","text":"We can't verify the ICE part at all. No reliable source for that claim. It's her account, posted by someone else."},{"host":"Jake","text":"But what's verified is she's actually built a whole second act online. Which, honestly, is the most 2026 sentence I've said all day."},{"host":"Nora","text":"Speaking of second acts: Dianna Agron from Glee is apparently recreating her viral 'I Say a Little Prayer' cover — with Myha'la and Ben Platt."},{"host":"Jake","text":"Hold on, that's... Pop Crave posted it, but there's no other confirmation? No announcement from Agron or Platt?"},{"host":"Nora","text":"Right. That cover was a genuine moment — Season 1, the wedding episode, millions of people heard it. But this 'recreation' is unverified."},{"host":"Jake","text":"So as of now, the only person recreating anything is Dianna Agron's hypothetical schedule. I'm not daydreaming about Glee covers."},{"host":"Nora","text":"A lot of people are, though. That song hit differently for a certain corner of the internet. The idea of Ben Platt in a church with that Glee energy..."},{"host":"Jake","text":"Okay, as a theater kid, I'll allow it. But only if someone confirms it. Until then, it's a rumor with good hair."},{"host":"Nora","text":"Last one's a quick thought from Jim Unwin on Bluesky: 'The business model for £100 million AAA games is also hope a streamer makes it go viral.'"},{"host":"Jake","text":"Wait, so you spend nine figures on a game, and the go-to-market plan is... 'send a code to a YouTuber and pray'?"},{"host":"Nora","text":"It's not the whole plan, but he's not wrong that a streamer can make a game take off these days."},{"host":"Jake","text":"And the same streamer can kill it! One 'this is mid' three-hour VOD, and your £100 million is toast by Tuesday."},{"host":"Nora","text":"So the real gamble isn't the engine or the story — it's whether some guy named Nick likes it on stream."},{"host":"Jake","text":"That's a broken system. But also... I'd watch that movie. 'Nick liked it, everyone's hired again.'"}]}