Eight compromised TLS certificates from eMudhra Limited, an Indian certificate authority, have been discovered with private keys so weak they could allow anyone to mint trusted browser and app credentials for any site on the Internet. The private keys ranged from 3 to 8 bits, which is extremely weak compared to the standard NIST P-384 elliptic curve cryptography private key size. This flaw could enable unauthorized certificate signing and trust exploitation, posing a significant security risk to the Internet.

The community is split on the cause of the issue. Filippo Valsorda argues it stems from a 'horribly dangerous key generation interface' with a misconfigured parameter, while Ben Cartwright-Cox suggests it might be example code that accidentally leaked to production. SocialistVibes01 warns that the cleanup job will be bigger than Heartbleed, affecting IoT devices, Docker containers, and forgotten Linux machines. Others note the incident highlights the need for better monitoring of certificate transparency logs and more proactive security measures.

The consensus is that the compromised certificates represent a critical security risk due to their extremely weak private keys. However, the debate over whether this is a simple mistake or a systemic failure in certificate authority oversight remains unresolved. The community calls for improved oversight and monitoring to prevent such vulnerabilities in the future.