eMudhra’s Weak Keys And The Cost Of Broken Trust

Most of us trust the internet without thinking much about what makes that trust possible. We open websites, make payments and share personal information, rarely stopping to consider the systems working behind the scenes. Until something goes wrong.

Last week, a security flaw at Indian digital trust company eMudhra sent ripples through the global internet security community. An independent researcher discovered that eight of its intermediate certificate authorities had cryptographically weak private keys. One of them was simply the number 4.

These keys help establish whether websites are genuine. If misused, they could have allowed someone to create fraudulent certificates and impersonate legitimate websites. The flaw had gone undetected for around 18 months, despite two rounds of independent audits.

On October 22, eMudhra announced it would exit its global SSL/TLS certificate business, which it said accounted for just 1% of its revenue. The company cited rising compliance costs, declining returns and what it described as disproportionate social media scrutiny.

It is a striking way to frame a failure in a business built around trust. The commercial value of a division may be small to a company, but the implications of a security flaw can extend far beyond its balance sheet.

At Decode, we have been reporting on such failures for years. In April 2025, we broke the story of a potential data leak at Apollo Hospitals, where exposed files contained Aadhaar and PAN cards, passports, patient medical records, vaccination reports, job applicants' resumes and credentials linked to internal systems.

Security researchers Akshay and Viral alerted Apollo and CERT-In, India’s nodal agency for responding to cybersecurity incidents. India’s largest hospital chain did not respond to the researchers or Decode before publication.

The unanswered questions were as troubling as the exposure itself. Had the data been accessed? What had been done to fix the vulnerabilities? Were affected people informed? The investigation brought the risks to light, but Apollo’s silence left critical questions unanswered.

Meanwhile, the responsibility for staying safe online is routinely placed on users. In November 2024, the National Payments Corporation of India had launched Main Moorkh Nahi Hoon, a UPI safety awareness campaign featuring Pankaj Tripathi. The six advertisements produced in 11 languages aimed to help people recognise common scams.

That education matters. But the campaign's name, which translates to "I am not a fool", raises a question about how we frame digital safety. People can be vigilant and still fall victim to fraud. They cannot independently audit a hospital's database or inspect the cryptographic keys used to secure a website.

Awareness is necessary. But it cannot become a substitute for accountability. When a system fails, the questions must go beyond how people can protect themselves next time.

Here are five stories which caught our attention this week-

AI Agents Found the Bugs That Nearly Broke the Internet

Two critical vulnerabilities in PHP, the programming language that helps run websites and powers around 70% of websites whose underlying technology is known, triggered a global scramble to secure online services. The flaws were serious enough to prompt some government websites to go offline while operators worked to protect their systems. Researchers used AI tools to help uncover how the decades-old bugs could be exploited, potentially allowing attackers to run malicious code on vulnerable servers without a password.

India Ranks 100th Among 122 Countries On Global Hunger Index

India ranks 100th among 122 countries in the 2026 Global Hunger Index, placing it in the “serious” hunger category. Nearly three in ten children under five are stunted, while 19% experience wasting. Against this backdrop, Decode’s investigation into facial recognition in child nutrition schemes found that failed face matches and missing documents were leaving some children without meals, preschool education and health monitoring.

Meta’s Privacy Practices Come With A $25 Billion Price Tag

A New Mexico judge has ordered Meta to pay $25 billion after a jury found the company violated state consumer-protection laws by misleading users about privacy and data protection. The case, linked in part to the Cambridge Analytica scandal, involved more than 43 million violations. Meta plans to appeal the ruling. The judgment adds to the scrutiny of how social media platforms continue to collect, handle and protect users’ personal information, and what consequences they face when they fail to do so.

Sourav Ganguly’s ‘Doosra’ And The Limits Of Personality Rights

The Delhi High Court has asked the makers of the movie Doosra to arrange a screening of the film as it considers former India cricket captain Sourav Ganguly’s claim that it violates his personality rights. The court declined to stay the film’s OTT release for now. The dispute is part of a wider set of legal battles over how far public figures can control the use of their names, images and likenesses. But these cases also raise a bigger question: where does the right to protect one’s identity end, and the right to criticise, parody or tell a story begin? Read Decode’s explainer on what India’s personality rights cases actually protect.

Smart Glasses Are Making Everyone A Potential Witness. And Everyone A Potential Target.

Smart glasses can record incidents from the wearer’s point of view, document disputes and even assist people with visual disabilities. But they also raise questions about covert recording, consent and the normalisation of surveillance in everyday life. A new report, The Connected Gaze, commissioned by the European Data Protection Board explores this tension: when recording becomes effortless, what happens to the privacy of everyone caught in the frame?

New On Decode

Over 200 takedowns during the anti-CEC protests affected protest videos, news reports and political memes. Government notices and automated systems left journalists and users with few ways to challenge removals. The post disappears, the notice cites the IT Rules, and the route to appeal remains unclear. (Read here)

In Case You Missed It

At Decode Internet this week, we followed stories of the risks and possibilities of digital spaces.

A Delhi Student Was Doxxed And Detained For A Women’s Safety WhatsApp Group
The group was meant to help Delhi University’s female students travel safely to the October 10 Jantar Mantar protest. Instead, their numbers went public. (Read here)

Lost On The Ganges, Found on Facebook: The Tale Of How A Man Was Reunited With His Boat
A Patna boatman’s search for his missing boat ended with a 56-second Facebook video posted by a local news page. (Read here)

Decode This Week is your weekly guide to the technology changing how we live, work and navigate the world around us. From AI and algorithms to scams, surveillance, platforms and digital policy, we look beyond the hype to ask a simple question: what does this mean for you?

Until next week :)