Recent security flaws involving eMudhra and PHP have raised concerns about ageing software and AI-driven vulnerability detection.
The incidents have renewed scrutiny of weaknesses in digital infrastructure, particularly as artificial intelligence makes identifying software vulnerabilities faster and more accessible. Cybersecurity specialists warn that flaws in widely trusted systems can remain undetected for years, while organisations may struggle to respond as quickly as new vulnerabilities are discovered.
What Did the eMudhra Security Incident Reveal?
On October 17, an independent security researcher using the alias Wayne discovered a critical cryptographic vulnerability involving eMudhra, an Indian Certifying Authority. The weakness originated from a script error that had reportedly remained undetected for approximately 18 months.
The discovery did not involve a cyberattack or data breach. However, it raised concerns about the reliability of digital certificates used to establish trust between websites and users.
Google, Mozilla, Apple and Microsoft blocked the affected intermediate certificates within hours. By October 22, eMudhra’s board had voluntarily withdrawn from the global SSL/TLS certificate business to concentrate on its core enterprise solutions. CERT-In also issued an advisory, while MeitY maintained that domestic certification and eSign services remained unaffected.
FCRF’s Chief AI Officer Certification Returns on November 14 to Prepare Future AI Leaders
How Did a Script Error Weaken Digital Certificates?
In April 2025, eMudhra conducted a key-generation ceremony involving eight intermediate Certificate Authorities. The cryptographic keys were created using secure hardware, but a weakness emerged during a process known as wrap and unwrap, which involved generating encrypted and decrypted copies for global operations.
Kaushik Srinivasan, co-founder of eMudhra, explained that the failure resulted from a scripting error rather than compromised infrastructure. One affected key was reportedly as simple as the number four.
“It’s a process lapse. There was no infrastructure attack. There was no data leak,” Srinivasan clarified.
The affected intermediate issuers were never placed into production, meaning they did not issue rogue website identity certificates. Nevertheless, the weakness highlighted the consequences of inadequate verification during sensitive cryptographic operations.
Why Does the Flaw Matter Beyond Web Browsers?
Digital certificates support the trust mechanisms used to verify website identities. A browser’s padlock symbol depends on certificates tracing back to trusted authorities, making the integrity of intermediate certificate keys particularly important.
Nandini Tandon, co-founder and Chief People Officer at Indusface, warned that possession of an intermediate CA key could allow an attacker to issue certificates accepted by affected systems.
Although major browser companies responded quickly, enterprise infrastructure presents additional challenges. APIs, payment integrations, mobile backends and older servers may maintain separate certificate trust stores that do not automatically receive browser security updates.
Consequently, organisations may need to identify affected certificates, update trust stores and independently verify that vulnerable certificates are no longer trusted.
What Have the PHP Vulnerabilities Highlighted?
The eMudhra disclosure coincided with concerns surrounding vulnerabilities in PHP, a widely used technology supporting websites and web applications. The weaknesses were serious enough to prompt an alert from the United States National Security Agency.
Several government websites across Europe reportedly went offline as a precautionary measure. The incidents drew attention to the continuing security risks associated with older software components.
Similar concerns have also emerged around Node.js, reinforcing questions about weaknesses in software developed and maintained over many years.
How Is AI Changing Cybersecurity Threats?
Artificial intelligence is accelerating vulnerability discovery by automating technical analysis, identifying coding weaknesses and assisting with reconnaissance. Security specialists argue that AI is exposing existing flaws rather than necessarily creating new ones.
“The internet was always vulnerable. AI is showing it the mirror,” Tandon observed.
Mandar Patil, Executive Vice President at Cyble, said AI can improve attackers’ efficiency by analysing documents, identifying malfunctions and supporting operational planning.
The development also raises questions about cybersecurity compliance. Saakar Yadav, founder and managing director of Lexlegis.ai, argued that faster vulnerability discovery could change expectations of reasonable security practices under existing legal frameworks.
What Must Organisations Do to Strengthen Defences?
Cybersecurity specialists recommend moving beyond occasional security assessments towards continuous, AI-assisted monitoring and vulnerability validation. Such systems can examine network activity, detect anomalies and identify weaknesses requiring attention.
However, automation cannot replace human oversight. Srinivasan cautioned that AI models can produce inaccurate information, making human verification essential.
“Pairing both human and AI controls to make the whole system more robust is where the focus must be,” he said.
The incidents also underline the importance of independent security audits, penetration testing and secure software development practices. Organisations must ensure that weaknesses identified through automated tools are properly investigated and corrected.
The broader concern is not simply that artificial intelligence can discover vulnerabilities more quickly, but whether organisations can maintain adequate safeguards as the pace of discovery increases.
Follow for daily updates on cybercrime, corporate fraud, DFIR, hacking, investigations, and digital forensics
