Eight certificates issued by India-based eMudhra have been compromised, theoretically allowing attackers to spoof trusted browser and app credentials. Cryptography engineer Filippo Valsorda told Ars that the number of affected devices means it’ll take longer to clean up than Heartbleed, an infamous OpenSSL vulnerability that rocked the internet in 2014 and took years to fix.