EXTENSIONS

Find where the leaked private keys of eight compromised eMudhra certificate authorities can still be used against you. Anyone can recover these keys (disclosed 2026-10-20, https://emudhra.we-have-a-problem.com/) and use them to impersonate any website or sign code that clients still trust. Browsers and OS stores block them, but curl, Python, Java, Go, Node.js, Deno, Electron apps and container images often still trust them. Checks Linux, macOS and Windows hosts, Linux and macOS machines over SSH, container images and running containers: PEM CA bundles and Java keystores matched by public key (honouring blocked.certs and OpenSSL trust settings), any EC CA whose private key is small enough to recover the same way, the macOS and Windows verifiers, and the versions of tools that carry their own roots (Node.js, Go, Deno, Bun, uv, pixi, rustup, mise, Claude Code, Docker Desktop, cloudflared, Cloudflare WARP, Electron apps) and the packages pinned in Cargo, Mix, rebar3, uv, Poetry, PDM, Pipenv and Composer lockfiles against the patched releases. Records exposed, protected or unknown per target for TLS and code signing, with what to do about it; changes nothing.