Desk note · industry · Digital trust / compliance
Mozilla and major browser vendors deployed emergency protections on 21 October 2026 against eight intermediate digital certificates issued by India’s eMudhra after private keys were compromised, a flaw that could let attackers impersonate legitimate websites; eMudhra shares fell sharply as the company acknowledged the issue.
On 21 October 2026, technology news outlets reported that browser makers had rushed out protections against eight intermediate digital certificates issued by eMudhra Ltd, one of India’s licensed certifying authorities. Mozilla’s security team published details showing private keys linked to those certificates were not adequately safeguarded. If attackers obtained the keys, they could mint fraudulent TLS certificates that browsers would trust, enabling phishing sites to masquerade as banks, government portals, or vendor logins. By Tuesday, major browser developers had deployed blocks so the vulnerable intermediates could not chain to live websites. eMudhra acknowledged the Mozilla disclosure in a blog post on its site and said it was coordinating with ecosystem partners. The NSE-listed company’s stock slid sharply in Wednesday’s session as traders priced in audit, customer churn, and regulator scrutiny.
Digital certificates are the quiet plumbing behind GST e-invoices, MCA filings, tender submissions, and countless B2B logins. A certifying authority does not need a headline data breach for damage: trust evaporates when browsers no longer accept its chain. Emergency distrust lists force customers to re-issue certificates, pause integrations, and prove to auditors that their signing keys were never crossed with the compromised intermediates. For SMEs, the practical risk is downtime on e-sign flows and delayed compliance filings until IT teams swap to fresh certs. For large enterprises, security teams must scan outbound links and API callbacks that relied on eMudhra-issued TLS assets. India's Controller of Certifying Authorities typically investigates key-management failures with suspension or penalty powers.
If your company uses eMudhra for DSC tokens, SSL, or document signing, ask your IT vendor today which certificate serial numbers were in production and whether replacements are already issued. Do not click through browser warnings on government or banking sites during the remediation window. Procurement teams should keep a backup certifying authority qualified for critical workflows. Investors in compliance-tech names should separate one-off remediation costs from lasting share loss. Watch CCA orders, eMudhra exchange disclosures, and whether other Indian CAs publish independent key-management audits after this episode.
Trade policy / exports
Commerce minister Piyush Goyal said on 22 October 2026 that India’s proposed free-trade agreement with the European Union could become operational within four to five months after signing, with the deal expected to be inked before year-end during his visit to Germany.
Food delivery / quick commerce
Swiggy reported on 22 October 2026 that September-quarter revenue rose 36% to about ₹7,571 crore and the consolidated net loss narrowed to ₹922 crore, as food delivery posted record adjusted core profit of about ₹349 crore while quick-commerce Instamart lost about ₹764 crore at the segment level amid heavier discounting and 69 new dark stores.
Quick-service restaurants / consumers
KFC and Pizza Hut operator Sapphire Foods India said on 22 October 2026 that September-quarter consolidated restaurant sales rose 20% year on year to about ₹885 crore, with KFC India same-store sales up 14% and adjusted EBITDA margin expanding 100 basis points to 7.1% even as the listed stock remained far below its 52-week high.
RBI / government borrowing
On 22 October 2026, the Reserve Bank of India accepted no bids at the scheduled sale of short-dated government treasury bills, the first full cancellation in about seven months, as investors demanded higher yields amid a bond selloff, oil-linked inflation fears, and expectations of more rate hikes after October’s policy minutes.
For informational purposes only. Not investment advice. Verify with filings and a licensed adviser.