eMudhra, the Indian cybersecurity firm that put the internet on alert last month due to shockingly weak security keys, has disclosed the incident in its full report. The report, published on the open-source bug tracking system Bugzilla, puts the blame on a Python scripting error.The incident stems from eight weak security keys that were used by eMudhra to issue digital certificates for websites.

These weak keys could’ve allowed anyone to obtain such certificates and set up fake websites online to scam users. Though after the incident was brought to light, Google, Mozilla, Apple, and Microsoft rushed to release security updates.How did eMudhra incident happen?eMudhra is a certificate authority (CA) responsible for issuing digital certificates to websites.

These certificates are given to verified websites as a way proof that they were secure – adding a padlock symbol beside the URL on browsers. However, in eMudhra’s case, these keys, which were supposed to be 115 digits long, turned out to be very short.

In one case, the key was just the number 4, making it alarmingly easy to hack.Going by eMudhra’s full report, the incident was sparked by a Python scripting error. The company said that when the keys were created during a ceremony on 30 April 2025, they were generated successfully on a “hardware security module,” or HSM.

During this key generation ceremony, the company processed them using a custom python script in preparation of transfer to a different hardware device. A bug in the script shrank eight of the keys into the tiny numbers which were found last month. eMudhra accepted that these numbers – 4, 56, 66, 115, 155, 156, 230 and 237 – were so small that anyone could’ve worked them out from the public domain.These keys went unnoticed for eighteen months as they keys still issued certificates as intended, and no one tested their strength.

At the same time, eight other keys, eMudhra added, remained intact, but the same script created copies of those keys in an ordinary computer’s memory. eMudhra said it revoked all 16 certificates connected to these affected keys as it could not guarantee that they met its own security policy.The report said that this was the first time eMudhra used such a process to transfer keys between hardware security modules (HSMs) in different geolocations. Since then, the company has generated keys without having to transfer them.Following the internet meltdown last month, eMudhra exited the digital certificate business entirely.

When the incident broke online, many experts were alarmed, with some claiming that it could’ve broken the internet. The company has apologised for the incident publicly.- Ends