Remediation on karmine's notes https://karmine05.github.io/dirtyfrag-blog/tags/remediation/ Recent content in Remediation on karmine's notes Hugo -- gohugo.io en dhruv@fleetdm.com (Dhruv Majumdar) dhruv@fleetdm.com (Dhruv Majumdar) © 2026 karmine's notes Wed, 21 Oct 2026 12:00:00 -0400 eMudhra CA Key Compromise: Find and Fix the Trust Stores Your Browser Doesn't Cover https://karmine05.github.io/dirtyfrag-blog/posts/emudhra-ca-compromise-fleet/ Wed, 21 Oct 2026 12:00:00 -0400 dhruv@fleetdm.com (Dhruv Majumdar) https://karmine05.github.io/dirtyfrag-blog/posts/emudhra-ca-compromise-fleet/ Eight eMudhra intermediate CA keys were generated as tiny, guessable numbers, so anyone can forge a trusted certificate for any website. Browsers and operating systems blocked them within three days. Everything that keeps its own copy of the trusted roots did not: Linux CA bundles, macOS /etc/ssl/cert.pem, Node.js, Python certifi, and the CA bundle Fleet’s own agent uses to reach the Fleet server. This brief explains the blast radius in plain words and ships three Fleet queries and three Fleet scripts (macOS, Windows, Linux) that find and fix the exposure, tested on real hosts and containers.