The post links Ars Technica's report that eight intermediate TLS certificates belonging to the India-based certificate authority eMudhra had private keys of only 3 to 8 bits (a normal P-384 key has about 384 bits), so anyone could use them to issue certificates that browsers and apps would trust for any site. Ars says browser makers and some major apps and programming languages had blocked all eight by Tuesday, with no sign yet of malicious use in certificate transparency logs, but cryptography engineer Filippo Valsorda called it "a massive cleanup job, bigger than Heartbleed," because of Linux distributions, containers and IoT devices. Exploiting it requires intercepting traffic.

Replies from defenders range from gallows humor about ruined evenings to disbelief at the key sizes. Others question why systems automatically trust so many certificate authorities, and note that the certificates had been cross-signed by Sectigo. About 3,100 upvotes in a 1.1-million-member community.