**[Google, Apple, and Others Urgently Revoke 8 Flawed Certificates from eMudhra, Potentially Allowing Forgery of Any Website]** According to a report by *Jinse Finance* on October 21, citing *Cointelegraph*, Google, Apple, Mozilla, and Microsoft have urgently revoked eight intermediate certificates issued by the Indian certificate authority eMudhra Limited. The revocation was due to a flaw in private key generation that made it susceptible to arbitrary guessing. This vulnerability could allow attackers to forge HTTPS certificates for any website, impersonate legitimate sites, and intercept or tamper with transmitted data. Mozilla encryption engineer Dennis Jackson stated in an incident report that after receiving the vulnerability notification last Saturday, he independently reconstructed the private key and confirmed that the key generation process was "flawed" and "highly exploitable." If attackers intercept user connections, they could use forged certificates to impersonate legitimate websites. The response times varied across platforms: Mozilla completed the revocation via OneCRL last Saturday and pushed updates for desktop and Android; Chrome began blocking the certificates on Saturday; Apple devices started on Monday; and Microsoft platforms followed on Tuesday. Cloudflare, informed on Monday, released updates for Cloudflare One, WARP, and other services on Tuesday. Jackson noted that the vulnerability was responsibly disclosed on October 19. Currently, there is no evidence that mainstream browsers have been exploited in such attacks, but clients outside the browser ecosystem remain at risk.