How did the secret become four?
On October 25, 2026, a post called “four” appeared on r/ProgrammerHumor. Its backdrop was real: eight eMudhra intermediate certificate authorities had extraordinarily weak private keys, including one whose value was literally 4. Such keys help establish trust in website certificates. They should be practically impossible to guess, not something a child can calculate.
The post paired a blue-cat illustration with private-key formatting. Some commenters credited Instagram’s @sillynubcat, but the original image upload has not been independently verified here. Follow the original thread rather than a reproduced image.
The real comments became a math lesson
A user asked why 4 was a meme. Another explained the incident. Asked how the key was discovered, a commenter replied, “Someone put two and two together.” This is an actual comment. In English the phrase means connecting clues, but here 2 + 2 is literally the secret key.
The term “brute force,” meaning trying possible values, sparked another exchange: did checking such small numbers even qualify as brute force? Someone suggested “Gentle force.” Imagine preparing to smash a door down, only to discover that a light tap opens it. Others contributed “4,” “Four” and “IV.” These are observed October 25–26 reactions, not a popularity ranking.
Why xkcd returned
Commenters recalled xkcd comic 221, “Random Number,” where a supposedly random number generator always returns 4. The comic did not predict the incident. Its intentionally terrible programming example merely found an uncanny real-world counterpart.
The serious part
Google says it received the report on October 17 and blocked trust in the affected keys. eMudhra says it revoked all eight intermediates on October 18, none had issued end-user certificates, and it had no evidence of a data breach. On October 22 it announced an exit from the global website-certificate business. A potentially severe flaw is not itself proof of an actual data leak.
Original sketch, not a Reddit comment
Interviewer: “Can you keep a secret?” Candidate: “Four.” Interviewer: “You just told me.” Candidate: “Fine, five.” Interviewer: “We’re not auctioning numbers.”
The punchline
The security response was serious. The comment section, however, turned advanced cryptography into the easiest math test imaginable: two plus two.
References (6)
- Reddit (2026-10-25, comments 25–26): https://www.reddit.com/r/ProgrammerHumor/comments/1xeul7g/four/
- eMudhra (2026-10-21): https://emudhra.com/en/post/certificate-security-incident
- eMudhra (2026-10-22): https://emudhra.com/en/press-release/emudhra-to-exit-global-ssl-tls-certificate-business
- Google Security (2026-10-20): https://blog.google/security/protecting-chrome-and-android-users-from-compromised-emudhra-intermediate-ca-certificates/
- xkcd 221: https://xkcd.com/221/
- Ars Technica (2026-10-22): https://arstechnica.com/security/2026/10/disgraced-emudhra-drops-out-of-tls-business-following-certificate-debacle/
