- Published on
8 eMudhra certificates are compromised. Here's what you need to know
- Authors
- Name
- DeepHorus
Cloudflare disclosed on October 19, 2026, at 17:00 UTC that private keys for eight eMudhra intermediate certificates were compromised. The certificates were widely trusted by browsers, operating systems, and Cloudflare itself. Because the keys are weak, an attacker could forge a certificate for any domain and impersonate servers to intercept or alter traffic.
Cloudflare said it immediately patched critical services to protect customers before public disclosure and found no active exploitation on its services. It released updates for Cloudflare One Clients, including WARP and the 1.1.1.1 app, and for Cloudflare Tunnel, or cloudflared. Mitigations were deployed across its CDN, Developer, and Zero Trust products. Customers using Cloudflare Zero Trust with Gateway and an up-to-date client are automatically protected.
The response focused on services that use public certificates to authenticate remote endpoints, including proxies connecting to origins and applications calling external APIs. Cloudflare also updated shared trust stores, base images, and other foundations, then reloaded, restarted, or redeployed systems. Applications with bundled or custom trust stores required separate assessment. Cloudflare stressed that the issue affects certificate-based authentication, not TLS encryption algorithms.
Customers may still need to act on software and trust configurations they operate, especially on origin servers. Developers should patch beneath SDKs because API clients may delegate verification to libraries, runtimes, operating systems, or custom settings. Cloudflare warned against disabling verification to clear certificate errors, as that would remove the intended protection.
Mozilla’s Dennis Jackson has crowdsourced patched packages and offers browser and non-browser tests. Cloudflare cautioned that a successful browser test does not prove every background service is protected. Results depend on the verification path tested.
Further remediation is underway, and impact varies. Browser maintainers can update one application, while organizations with many systems face more work. Customers should upgrade dependencies, rebuild images, and validate each application’s TLS path.
