“These keys could allow attackers to issue fraudulent HTTPS certificates for websites they do not control.”
Someone got the private keys to eight intermediate certificates every browser trusted. That is a license to impersonate any HTTPS site. Mozilla blocked them in under three hours and is pulling the root. The whole web still depends on dozens of certificate authorities never slipping like this.