A demonstration has alleged an OTP-login bypass at eMudhra, but only the original social post’s title could be extracted, so neither the bypass nor claimed certificate theft was independently verified. Separately, Mozilla’s incident record says questions sent on October 20 remained unanswered on October 23 after an initial 24-hour deadline and a requested extension. The company cited social-media scrutiny and investor responses as obstacles to analysis; root-program participants rejected that explanation. Its previously announced TLS-business withdrawal does not remove obligations to provide a root-cause report and maintain certificate-status services.