There's reports of a certificate authority having been compromised back on October 17th. This is just reaching the news this morning:

eMudhra, which issues signed certificates had been using numbers from 1 to 256 as their secret key instead of a random number on the P-384 curve. This could have been known to attackers for over a year - as early as April last year - and enabled man-in-the-middle attacks.

As soon as the story broke, I sent a security advisory to the employees at my client's companies, urging to update their browser, windows, and phones. I began working through the released material from Google, Microsoft, and other relevant organizations to see whether they had taken steps to remediate the compromise.

In the end it looks like most people are not at risk at this time. There was a window of time from October 17th to October 20th where attackers could have used forged certificates to serve phishing websites with no warning popup.

My advice - make sure you have MFA enabled and think twice before you enter your password on a website.