Indian certificate authority eMudhra issued eight TLS certificates with extremely weak private keys, some only a few bits in size. VPN users face the most immediate risk, though exploitation requires an active adversary-in-the-middle attack.

— via Bruce Schneier blog, Bruce Schneier