On October 17, 2026, a researcher identified as "Wayne" reported to Mozilla that eight intermediate CA certificates operated by India-based eMudhra had private keys so weak they could be trivially derived from their public certificates. The private keys were NIST P-384 elliptic curve keys with effective values of 4, 56, 66, 115, 155, 156, 230 and 237 — essentially numbers with 3 to 8 bits of entropy rather than the expected ~384 bits. Wayne proved control by signing the message "We have a problem here" with each private key. eMudhra revoked the intermediates on October 18, and browsers including Firefox, Chrome, Safari and Edge pushed emergency blocks. Mozilla emergency-distrusted the emSign ECC Root CA - G3 on October 20. No exploitation has been confirmed, and CT logs show no malicious c
The keys were generated during a single key ceremony on April 30, 2025, using an insecure key generation mechanism that produced non-random values. This is a key generation flaw, not a signature algorithm flaw. The incident escalated during what social media dubbed "Black October" — a 48-hour window in which numerous serious vulnerabilities and breaches were disclosed simultaneously.
The eMudhra intermediate CA private keys were indeed trivially weak — values like 4, 56, 66, 115, 155, 156, 230 and 237 — and were recoverable without AI. The researcher's broader claim that only 6 of 25 "Black October" incidents involved AI aligns with SecurityToday's analysis that the surge was mostly in disclosures, not AI-driven attacks.
NThe internet spent a week calling it 'Black October' — a nightmare wave of AI-driven cyberattacks. A security researcher just went through all 25 incidents on the viral lists...
NAI did the work in six of them. Six. The other nineteen? Nothing to do with AI.
JWait, hold on. The whole panic was 'AI hackers are here'? That was the story?
NThat was the story. And the best part — the one that got everyone's attention — the private key was literally the number four.
JFour. Not a brute-force attack. Not some supercomputer. The encryption key was four.
NA certificate authority in India called eMudhra. Their intermediate CA private keys were NIST P-384 elliptic curve values... except someone generated them wrong.
NThe values were 4, 56, 66, 115, 155, 156, 230 and 237. Three to eight bits of entropy instead of 384.
JSo you could guess them with, like, a calculator. A child could guess 'four'.
NAnd the researcher proved it by signing a message with each private key. The message said: 'We have a problem here.'
JOkay. That's actually a power move. Signs it eight times with the broken keys and sends it in.
NMozilla, Chrome, Safari, Edge — everyone pushed emergency blocks within two days. eMudhra revoked the intermediates on October 18th.
JSo the good news is they caught it. As far as anyone has reported, no malicious certificates were issued in the wild before discovery. But here's my thing...
JThe company then put out a press release saying the keys were 'reverse-engineered possibly with AI-assisted techniques.' AI! The key was FOUR.
NThat's the cover, and it's shameless. Sophie Schmieg, a security engineer, tore that apart. Said you could recover the key by hand.
JBut it worked, right? Because the Black October narrative was already there. AI this, AI that. The internet wanted it to be AI.
NAnd the researcher's actual point stands: most of these incidents were just... regular old bad security. A key someone set to four isn't a sci-fi threat.
JNo, it's almost worse. We spent a week terrified of the wrong monster while the real one was a guy typing '4' and calling it encryption.
NSecurityToday put out the same analysis — the surge in 'Black October' was mostly in disclosures, not AI-driven attacks. The panic outpaced the fact-check.
JAnd now we're here, a month later, still correcting people who swear AI did it. Meanwhile the certificate authority still hasn't really explained how they generated the number four.
NThere's a site for it now — Dennis Jackson made one. It's literally a site named after that message, 'We have a problem here.'
JI respect the naming. Look, if I hear one more 'AI did it' for something that was just an intern typing badly...
NThen you'll type an angry post that also gets zero entropy. Different world entirely: Tan Mom's back.
JOh no. Patricia Krentcil? The tanning-bed lady from 2012?
NShe's a tanning influencer now, apparently. And there's a post going around that she says ICE approached her and asked if she was an American citizen — claims it was racially motivated.
JThat's... quite a leap from 'mom loves tanning.'
NWe can't verify the ICE part at all. No reliable source for that claim. It's her account, posted by someone else.
JBut what's verified is she's actually built a whole second act online. Which, honestly, is the most 2026 sentence I've said all day.
NSpeaking of second acts: Dianna Agron from Glee is apparently recreating her viral 'I Say a Little Prayer' cover — with Myha'la and Ben Platt.
JHold on, that's... Pop Crave posted it, but there's no other confirmation? No announcement from Agron or Platt?
NRight. That cover was a genuine moment — Season 1, the wedding episode, millions of people heard it. But this 'recreation' is unverified.
JSo as of now, the only person recreating anything is Dianna Agron's hypothetical schedule. I'm not daydreaming about Glee covers.
NA lot of people are, though. That song hit differently for a certain corner of the internet. The idea of Ben Platt in a church with that Glee energy...
JOkay, as a theater kid, I'll allow it. But only if someone confirms it. Until then, it's a rumor with good hair.
NLast one's a quick thought from Jim Unwin on Bluesky: 'The business model for £100 million AAA games is also hope a streamer makes it go viral.'
JWait, so you spend nine figures on a game, and the go-to-market plan is... 'send a code to a YouTuber and pray'?
NIt's not the whole plan, but he's not wrong that a streamer can make a game take off these days.
JAnd the same streamer can kill it! One 'this is mid' three-hour VOD, and your £100 million is toast by Tuesday.
NSo the real gamble isn't the engine or the story — it's whether some guy named Nick likes it on stream.
JThat's a broken system. But also... I'd watch that movie. 'Nick liked it, everyone's hired again.'