New Delhi: The internet is facing a reckoning as legacy software vulnerabilities come to light, prompting a broader conversation about the historical quality of human-written code. Observers and tech commentators on social media have pointed out that fears of artificial intelligence generating faulty code often overshadow the reality that decades of foundational software were built with subtle, undetected flaws now being brought to the surface by advanced automated tools.
This discourse follows a turbulent period dubbed Black October, marked by significant digital security scares. On October 17, an independent researcher discovered a critical cryptographic flaw linked to eMudhra, a prominent Indian Certifying Authority. Rather than stemming from an active data breach or malicious hack, the issue originated from a script error that remained hidden in plain sight for 18 months.
Tech giants including Google, Mozilla, Apple, and Microsoft swiftly blocked the affected intermediate certificates following the discovery. By October 22, eMudhra's board voluntarily withdrew from the global SSL/TLS certificate business to concentrate on core enterprise solutions. While the Indian Computer Emergency Response Team issued an advisory, the Ministry of Electronics and Information Technology assured the public that domestic certifying ecosystems and eSign services remained secure.
Simultaneously, the global web infrastructure faced another major test as critical flaws were identified within PHP, a programming language that drives a vast majority of websites and applications worldwide. The discoveries prompted security alerts from agencies like the United States National Security Agency, while several government websites across Europe went offline temporarily as a precautionary measure.
Industry insiders emphasize that these incidents demonstrate how the internet was inherently fragile long before the advent of modern AI tools. Rather than introducing new vulnerabilities, artificial intelligence and advanced analysis are acting as a mirror, exposing poor human coding practices that previously went unnoticed due to a lack of sufficient inspection tools.
Explaining the eMudhra incident, company co-founder Kaushik Srinivasan clarified that the failure occurred during a technological process known as wrap and unwrap, which is intended to export keys for global operations through encrypted and decrypted copies. A script error during the decrypted copies phase resulted in an overly simplistic key, with one instance turning out to be the number four.
Fortunately, the compromised intermediate issuers were never deployed into production, meaning no unauthorized identity certificates were issued, and no infrastructure attack or data leak took place. Nevertheless, the situation has drawn intense global scrutiny to the mechanisms underpinning digital trust.
Security experts note that everyday digital safeguards, such as the padlock icon indicating a secure connection, rely on an intricate chain of trust that extends to certifying authorities. Nandini Tandon, co-founder and chief people officer at Indusface, explained that an intermediate authority sits high within that chain, meaning compromises at that level threaten digital identity verification rather than the underlying encryption itself.