EMudhra Intermediate CA Certificates Compromised
2026-10-22T20:51:33Z•b31ed743d12da237f06dce4a7b9a23d33b27771d2170f0b0a34ec6164de9456b
CVE-2024-47575CVE-2026-0257CVE-2026-109618CVE-2026-109619CVE-2026-88771CVE-2026-88772AI-assisted-cybercrimeAI-espionageFortiGateFortiManagerIncLinuxNetScalerOAuth-attacksPAN-OSPEERSTITCHPHPQilinTLS-certificatesactive-exploitationcertificate-authority-compromisecloud-securitycredential-theftinitial-accessman-in-the-middlephishingransomwarethreat-intelligencevulnerability-exploitationweb-shellszero-day
What happened
Unit 42's October 2026 threat intelligence feed covers compromised eMudhra intermediate CA private keys enabling unauthorized TLS signing and man-in-the-middle interception; modern OAuth abuse; critical PHP vulnerabilities CVE-2026-109618 and CVE-2026-109619; AI-assisted cybercrime and espionage; active exploitation of PAN-OS CVE-2026-0257 by ransomware groups; widespread FortiGate targeting via CVE-2024-47575 and PEERSTITCH; exploited NetScaler zero-days CVE-2026-88771 and CVE-2026-88772; and campaigns involving phishing, credential theft, cloud and software supply-chain compromise, Linux web
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- paloalto_unit42
- Record identifier
- b31ed743d12da237f06dce4a7b9a23d33b27771d2170f0b0a34ec6164de9456b
- Enrichment time
- 2026-10-22T20:51:33Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.