eMudhra's guessable keys, a Claude that pings first, and SBI's leak scare
An Indian certificate authority's weak keys forced every major browser to act, Anthropic's new agent messages you before you ask, and SBI is checking a suspected data leak. Plus a Telegram privacy fix and a question about OPPO's pricing.
- Long Press · Daily Five22 Oct 202601 / 05
commentaryIndiaeMudhra's secret keys were numbers you could guess
Google, Mozilla, Apple and Microsoft blocked eight intermediate certificates from Indian certificate authority eMudhra between October 17 and 20, 2026, after a researcher found their private keys were numbers like 4, 56 and 115, Help Net Security reported. That's the kind of mistake you'd expect from a student project, not a company whose whole job is vouching that a website is who it says it is. The browsers reacted within hours, which is the system working. What worries me more is the long tail of apps and servers that never check whether a certificate was revoked.
The questionWhat happened with the eMudhra certificate keys in October 2026?
In one lineIn October 2026, Google, Mozilla, Apple and Microsoft blocked eight intermediate certificates from Indian certificate authority eMudhra after a researcher found their private keys were tiny numbers like 4, 56 and 115. Anyone could have forged HTTPS certificates with them. No misuse has been reported.
The problem
Every padlock in your browser depends on a few hundred certificate authorities keeping their private keys secret and properly random. If one of them slips, someone can impersonate a bank or a government site and your browser will happily show the padlock.
What changed
A researcher called Wayne spotted the flaw on October 17 and signed a message with all eight keys to prove it, per Help Net Security. The keys came from an April 2025 ceremony where a faulty script created weak lookalike keys. Chrome and Firefox blocked them the same day, Apple followed on October 19 and Microsoft on October 20, and The420 reports eMudhra's shares fell about 20% to the lower circuit.
The catch
The keys were effectively public for about 17 months and nobody can say for sure they weren't used. Scott Helme found curl, Python, Node, Go and Java would accept a forged certificate for Stripe's API, according to CoinDesk.
What it means for you
Update your browser and phone today if you've been putting it off. If you build software, update your language runtime and certificate bundles, because revocation won't reach a static trust store on its own.
Questions people ask
Why were eMudhra's certificate keys so weak?
eMudhra traced it to a faulty script used in an April 2025 key ceremony, which created a second set of weak keys with labels that looked like the real ones, and staff picked the wrong set. It admitted human error at several steps and says it will re-check every key ceremony it has run.
Do I need to do anything after the eMudhra certificate compromise?
Update your browser and operating system, since Chrome, Firefox, Apple and Microsoft have already blocked the eight certificates. The bigger risk is software that never checks revocation: Scott Helme showed curl, Python, Node, Go and Java accepting a forged certificate, so developers should update trust stores and libraries.
How did eMudhra shares react to the key compromise?
eMudhra shares fell about 20% and hit the lower circuit on October 21, 2026, according to The420. The company says only one of the eight intermediates went into production, none issued customer certificates, and about 30,000 customer certificates under the affected root will still need replacing.
- Long Press · Daily Five22 Oct 202602 / 05
aiClaude Duet doesn't wait for you to type
Anthropic opened a waitlist in October 2026 for Claude Duet, a research-preview agent that messages you first instead of waiting for a prompt, according to Anthropic. Proactive is the right direction, because most of us don't need a smarter chatbot, we need fewer things falling through the cracks. But an assistant that pings you is only as good as its sense of what's urgent, and Anthropic itself says this one can misread a thread or misjudge priority.
The questionWhat is Claude Duet and is it available in India?
In one lineClaude Duet is a research-preview personal AI agent from Anthropic, launched in October 2026, that messages you first with briefs and follow-ups and asks before sending messages or making payments. It's not available in India yet: the waitlist is open only to US Pro and Max subscribers.
The problem
Chat assistants are reactive. They're useful once you remember to ask, which is exactly the moment the forgotten invoice or unanswered email has already become a problem.
What changed
Claude Duet is a standalone app on iOS, Android and the web that sends a morning brief, handles inbox and calendar follow-ups, and runs bigger tasks on its own cloud computer, per Anthropic. It plugs into more than 6,000 connectors and asks before sensitive actions like sending messages or making payments.
The catch
It's a US-only waitlist for Pro and Max subscribers, Team and Enterprise aren't included, and its background checks draw down your plan's usage. Anthropic warns it can miss something that arrives between check-ins.
What it means for you
Indian users can't get it yet, so watch for how well it judges urgency once reviews land. The approval-before-sending design is the bit worth copying into whatever agent you do use.
Questions people ask
What can Claude Duet actually do?
Claude Duet watches your inbox and calendar, sends a morning brief, drafts replies, chases follow-ups and takes on bigger jobs like scheduling meetings or building dashboards. It works on its own cloud computer, connects to more than 6,000 apps including Gmail, Slack and Stripe, and asks for approval before sending messages or paying anyone.
Does Claude Duet cost extra?
Anthropic doesn't list a separate price for Claude Duet. It runs on your existing Pro or Max plan's usage limits, and its background checks count against them, so a busy assistant that checks in often will eat into the same quota you use for regular Claude chats.
SourcesAnthropic ↗
- Long Press · Daily Five22 Oct 202603 / 05
tipStop strangers finding you on Telegram by your number
Telegram lets you hide your number and block strangers from finding you by it: Settings > Privacy and Security > Phone Number, set it to Nobody, then set 'Who can find me by my number' to My Contacts, as Bitdefender walks through. It takes half a minute. With SBI investigating a suspected leak of customer phone numbers this week, it's a good time to shut one of the easiest lookups a scammer has.
The questionHow do I stop people finding me on Telegram by my phone number?
In one lineOpen Telegram, go to Settings > Privacy and Security > Phone Number, set 'Who can see my phone number' to Nobody, then set 'Who can find me by my number' to My Contacts. Someone who only has your number can then no longer pull up your Telegram profile or start a chat.
The problem
Phone numbers leak constantly, from bank records to shopping sites, and on Telegram a number can be a lookup key for your name, photo and a direct chat.
What changed
Two settings fix it. Set who can see your number to Nobody, and the extra option 'Who can find me by my number' appears; set that to My Contacts.
The catch
People already in your contacts can still find you, and a public username works as a way in regardless. Hiding your number doesn't hide your account from Telegram itself.
What it means for you
Do it now, then check your username isn't your full name. If you don't use Telegram much, it's still worth doing, since a dormant profile with your photo is just as easy to look up.
Questions people ask
Can my saved contacts still find me on Telegram after hiding my number?
Yes. With 'Who can find me by my number' set to My Contacts, people saved in your phone's contacts can still find you and see your number. Strangers who got your number from a leaked list or a WhatsApp group can't use it to look up your Telegram profile, name or photo.
Does hiding my number make me anonymous on Telegram?
No. Telegram still needs a phone number to create the account and keeps account data such as your username, IP address and device details, according to Bitdefender. If you share a public username, anyone can still message you through it, so pick one that doesn't reveal your full name.
SourcesBitdefender ↗
- Long Press · Daily Five22 Oct 202604 / 05
myth busterIndiaA caller knowing your SBI details doesn't make them SBI
SBI is investigating a suspected leak of customer data after alerts on October 16, 2026, with 3,897 records reportedly carrying names, mobile numbers, dates of birth and addresses, The420 reported. The myth this feeds is an old one: if a caller knows your details, they must be from the bank. It's the opposite. Leaked details are what make a fake call convincing, and they tell you nothing about who's on the line.
The questionIs SBI customer data leaked on the dark web in October 2026?
In one lineSBI said on October 21, 2026 that it is investigating a suspected leak after alerts from October 16. A review reportedly found 3,897 records with names, mobile numbers, dates of birth and addresses. SBI hasn't confirmed the data is genuine and says core operations aren't affected.
The problem
Fake bank calls work because callers sound informed. When someone reads out your date of birth and branch, most people relax, which is exactly what the script is designed to do.
What changed
SBI received alerts from its threat intelligence provider, the Defence Cyber Agency and CERT-In on October 16 and filed a disclosure on October 21, per The420. A preliminary review of about 375,000 dark web records found 3,897 with personal information, including CIF IDs and loan metadata. SBI has brought in a CERT-In-empanelled agency.
The catch
SBI hasn't confirmed the records are genuine or where they came from, and it says the exposure hasn't materially affected its operations. That's the honest state of it: suspected, not proven.
What it means for you
Whether or not this particular leak is real, the rule holds for every bank. Hang up, call the number on your card, never share an OTP or PIN, and call 1930 at once if money goes.
Questions people ask
What SBI customer details were reportedly exposed?
The records reportedly include registered mobile numbers, dates of birth, names, gender, email addresses and home addresses, plus branch identifiers, Customer Information File IDs and loan or lead metadata, according to The420. SBI says it hasn't yet established the authenticity, source or full extent of the exposure.
What should SBI customers do after the suspected data leak?
Treat any call quoting your date of birth, branch or account details with more suspicion, not less. Hang up and call back on the number printed on your card or in the official app, never share an OTP, PIN or screen-share, and call 1930 immediately if money leaves your account.
SourcesThe420 ↗
- Long Press · Daily Five22 Oct 202605 / 05
communityIndiaWould you pay Rs 1.3 lakh for an OPPO?
OPPO launches the Find X10 series in India today, and leaked prices from tipster Debayan Roy put the Find X10 at Rs 1,29,999 and the Pro Max at Rs 1,59,999 or Rs 1,89,999, per Digit. Those are rumours until OPPO announces them, but the Find X9 started at Rs 74,999. Would you pay iPhone Pro money for an Android phone, or wait for the bank offers?
SourcesDigit ↗
Taps
Quick hits. One line each, for when a long press is too much.
- IndiaInc42 ↗
Jio's IPO was 3.15x subscribed on day one, but retail bid only 0.72x
Institutions bid 9.42x for the Rs 30,213 crore issue, which closes October 23, per Inc42.
- IndiaInc42 ↗
Eternal's Q2 profit nearly doubled to Rs 125 crore as Blinkit hit 2,751 stores
Operating revenue rose 78% to Rs 24,138 crore, and it wants 3,500-plus Blinkit stores by March 2027, per Inc42.
- GlobalWiz ↗
PHP patched two AI-assisted bugs that reach back to PHP 5.4
Wiz found them using Gemini 4 Argon and GPT-5.6 Sol. Patches shipped October 21, and updating is the only full fix.
- GlobalThe Hacker News ↗
GitLab fixed a CVSS 10 flaw in every self-managed release since 2014
No workaround and no known exploitation yet, per The Hacker News. GitLab.com users don't need to do anything.
- GlobalSafeDep ↗
LiteLLM 1.107.0 on PyPI shipped a credential stealer and a backdoor
It runs whenever Python starts, even without importing litellm, per SafeDep. Move to 1.106.2 and rotate keys on affected machines.