DPI Brief — October 22, 2026

Coverage window: 21 October 2026, 08:00–22 October 2026, 08:00 IST.

The most consequential development was a CERT-In alert on compromised eMudhra public-web certificate keys. The window also brought NPCI’s daily transaction snapshot and the scheduled first day of a nationwide financial-inclusion camp drive. Most other DPI layers were quiet in the official feeds reviewed; absence of a new notice is not evidence that a service had no operational changes.

1. CERT-In warns of weak eMudhra intermediate CA keys (L7 — trust)

CERT-In’s 21 October advisory says eight eMudhra intermediate certificate-authority keys were generated with insufficient randomness. The agency specifies that the affected P-384 elliptic-curve private-key values were smaller than 256 and could be recovered almost instantly from the corresponding public keys. That does not mean the P-384 algorithm itself is broken: the failure was in key generation. A recovered key could be used to create fraudulent TLS certificates, impersonate websites, or—if a client still trusts the chain and an attacker can intercept traffic—enable man-in-the-middle attacks. CERT-In also flags risk from compromised code-signing keys.

The agency reports eMudhra’s statement that none of the eight affected intermediates issued end-entity certificates, and that the affected intermediates—not the company’s root private keys—were in scope. CERT-In says the domestic Indian digital-signature-certificate and eSign infrastructure is unaffected, and that the public disclosures reviewed do not establish confirmed exploitation. That is a material distinction: this is a real trust-chain failure with potential for abuse, but the advisory does not report a confirmed victim or successful attack.

CERT-In asks administrators to update browsers and trust stores, identify certificates chaining to the affected intermediates or emSign ECC Root CA - G3, replace certificates that will no longer be trusted, and monitor Certificate Transparency logs. It also cautions against bypassing certificate warnings. The alert matters beyond TLS: public digital services rely on certificate trust to authenticate websites and signed software.

2. eMudhra narrows its impact account; root-store migration remains (L7 — trust; L3 — digital signatures)

In its statement updated 21 October, eMudhra says the issue came from a flawed wrap/unwrap step in an April 2025 key-generation ceremony. It says seven affected intermediates were never used in production; one was deployed but issued no certificate. The company says the incident affects one customer ecosystem in the United States, that its Indian eSign and digital-signature services remain unaffected, and that it is replacing the customer’s certificates. These are the company’s own findings, not an independent audit conclusion; its investigation is still open.

Google’s Chrome and Android response describes blocking the affected public-key hashes, with equivalent Android protection distributed through Google Play services. Google says the broader Chrome Root Store removal of emSign ECC Root CA - G3 is expected on 27 October; legitimate certificates under that root may stop working until replaced. Website operators should check their actual certificate chains and follow vendor guidance. CERT-In’s advisory also links to Mozilla’s response, including Firefox revocation-list and trust-store changes. These safeguards reduce exposure, but separate application, operating-system and embedded-device trust stores can lag.

3. NPCI publishes 20 October payment-rail figures (L2 — payments)

NPCI’s daily statistics card posted on 21 October records 787.89 million BHIM UPI transactions worth ₹75,358.48 crore on 20 October. It also reports 2.70 million AePS transactions worth ₹622.29 crore, 9.17 million IMPS transactions worth ₹14,342.97 crore, and 10.21 million NETC transactions worth ₹213.78 crore. The card is a one-day snapshot; BHIM UPI should not be read as a complete measure of all UPI activity, and volumes do not disclose success rates, reversals, fraud losses or bank-level outages.

4. Financial-inclusion drive reaches its scheduled start (L1, L2 and L6)

The Department of Financial Services’ 19 October notice sets 21 October as the start of camps planned through 31 December across 2.70 lakh Gram Panchayats and Urban Local Bodies. Banks are to support PMJDY accounts, PMJJBY/PMSBY/APY enrolment, Aadhaar seeding for PMJJBY/PMSBY, re-KYC, pending Central KYC IDs, nomination updates, Kisan Credit Card applications and crop-insurance enrolment, alongside digital-fraud awareness. The start date falls inside this brief’s window, but the notice is a plan—not evidence that camps ran, applications succeeded or complaints were resolved. The useful next disclosure is district-level delivery and failure data, including whether people can complete services without unnecessary Aadhaar linking or repeat visits.

Seven-layer scan

  • L1 Identity: Camp drive includes Aadhaar seeding and re-KYC; no new UIDAI rule located.
  • L2 Payments: NPCI’s daily rail figures above; no new UPI rule identified.
  • L3 Documents: No new DigiLocker, API Setu or eSign platform notice; CERT-In says Indian eSign is not affected.
  • L4 Commerce: No qualifying new ONDC or GeM update found.
  • L5 Sectoral: No qualifying new ABHA/ABDM or AgriStack update found.
  • L6 Governance: The DFS camp plan is the relevant local-delivery item; no new CPGRAMS or eOffice change found.
  • L7 Trust: CERT-In’s eMudhra advisory is the major update; no separate new DPDP or TRAI item located.

Watch next: Confirmation of camp delivery and exclusions; replacement of certificates under the distrusted root; and public reporting on failed or reversed payment transactions, not only throughput.