Weeknotes 2026-10-25

Sigh, time continues to advance! The World The US midterms are in less than 10 days! I say this with a mixture of dread and anticipation for the world. The cybersecurity industry has had quite a week: Eight intermediate certificate authorities were compromised because of a massively bad practice: The compromised eMudhra keys were defective at a level that’s challenging the imagination of many of the engineers studying the incident. A normal size for a NIST P-384 elliptic curve cryptography private key contains roughly 384 bits of entropy, a size allowing almost 2384, or a number with 116 digits, different possibilities. The private key sizes of the compromised keys ranged from 3 to 8 bits. Astonishingly, the private keys were 4, 56, 66, 115, 155, 156, 230, 237. Cue the many references to XKCD #221. This was a fail so bad, the provider just straight up quit the industry. Almost immediately after that incident came out, two new critical PHP vulnerabilities were discovered that affected…