How eMudhra Signed for a Year With a ‘4’ as a Private Key: Uneasy Money

The episode starts with two internet failures that the hosts frame as signs that the web’s trust layers are fraying: a certificate authority, eMudhra, had a private key that was literally the number 4 for more than a year, and some PHP flaws created a fresh remote-code-execution problem across huge swaths of the web. The host argues that both incidents expose how much of the internet still depends on brittle, human-heavy trust systems that only look secure because everyone assumes the other side is doing the right thing.

The discussion of eMudhra focuses on revocation and the awkward reality that browsers, device makers, and certificate ecosystems do not all handle bad certificates the same way. The host and the guests worry less about the initial mistake than about how long it could persist, how many devices may still trust it, and how easy it is for a determined attacker to weaponize a trivial weak key once it is known.

From there, the conversation shifts to PHP, where the hosts describe a large-scale patching effort for vulnerabilities that could let attackers run code on exposed servers. They connect it to the long tail of old WordPress, bank, government, and shared-hosting infrastructure, with Cloudflare trying to shield sites while the patch rolls out. The episode then moves into crypto-native mechanics with Paper Trade, DeepSeek, and the recurring theme that complex incentive systems and widely deployed software often fail in surprisingly simple ways.