Tracking Exploitation and Patching of eMudhra’s Weak Keys
Following the discovery of shockingly weak cryptographic keys generated by certificate authority eMudhra, security teams have raced to assess the damage, patch vulnerable systems, and monitor the Internet for potential exploitation.
Radwan AbdulhadiEditor and technology writer
Unprecedented Weakness in Certificate Authority Keys
On October 19, 2026, security researchers learned about eMudhra’s eight shockingly weak keys. Instead of picking a robust 115-digit number for a virtual combination lock to protect connections across the Internet, the certificate authority chose the number 4. Even worse, it was not a four-digit number, but simply the single digit 4. Other keys in the set were similarly vulnerable, including 56, 66, 115, 155, 156, 230, and 237.
The implications of this incident are severe. While past certificate authority compromises—such as incidents involving DigiNotar, TÜRKTRUST, and TrustWave—restricted key access to a limited group of attackers or organizations for issuing fraudulent certificates, the eMudhra incident differs fundamentally. The affected intermediate private keys could be recovered almost instantly by anyone directly from public certificates. This meant that anyone could independently recover the signing keys and generate valid-looking certificates for any domain accepted by unpatched clients that do not enforce Certificate Transparency.
In response to the cryptographic failure, eMudhra announced it is exiting the public certification authority business. The organization attributed the issue to a mistake in its key generation script, though it has not yet publicly shared the script. Further complicating the timeline, the authority signed a certificate revocation list with a potentially correctly generated key before correcting it to be signed with the weak key.
Rapid Remediation and AI-Assisted Code Analysis
Following the disclosure, organizations quickly initiated mitigation protocols. Cloudflare published initial developer guidance outlining the immediate action required to mitigate the leak and detailing what customers needed to do on their end to remain secure against potential certificate impersonation attempts.
Cloudflare began patching high-impact infrastructure immediately on October 19. These targets included customer origin-facing proxies built on Pingora, which handle the vast majority of the network's outbound connections. Engineers patched these proxies within hours to actively reject the vulnerable eMudhra keys.
Simultaneously, the engineering team deployed an AI-assisted analysis tool to scan internal source code repositories to identify every system that trusted the weak keys. Within four hours, the analysis completed. Teams assigned preliminary analytical tickets to each system for confirmation, ensuring that high-impact systems were patched immediately while lower-impact targets followed shortly after.
Monitoring Exploitation Attempts Across Global Infrastructure
To monitor whether customer servers or potential attackers attempted to present certificates signed by eMudhra's weak keys, infrastructure teams integrated advanced logging capabilities into Pingora. Because this outbound service manages the vast majority of outgoing TLS connections from network machines, any snooping attempts utilizing the weak keys would instantly trigger logging mechanisms.
One week after rolling out the logging systems, network analytics captured approximately 22,000 attempted handshakes employing the weak eMudhra keys. Notably, two-thirds of these attempts represented fetches of designated test sites, including domains such as emudhra.we-have-a-problem.com, which security advisories highlighted in previous developer guidance documents.
Almost all of the remaining third of connection attempts were directed at origin servers that appeared to have independently configured certificates using the weak intermediate key. Because network layers had already been patched, every single handshake configured to verify certificates was successfully refused.
Analysis of Forged Certificates and Client Trust
Among the observed traffic, roughly 160 handshakes stood out due to anomalous Subject Alternative Names naming external organizations and consumer Internet of Things devices, unrelated to the requested Server Name Indication. Investigators observed that these forged certificates were generated immediately after the keys leaked, with some carrying validity periods stretching over two years—far longer than permitted public CA issuance windows.
Despite these forged certificates appearing shortly after the vulnerability became public—with one dated October 20 at 18:19 UTC, less than an hour after a public bug report—they resembled default server certificates rather than active interception attempts. Because they referenced domain names inconsistent with the requested connections, hostname verification checks caused them to fail automatically.
To evaluate whether visitors still trusted the weak keys without disrupting active browsing sessions, network operators implemented indirect testing methods using challenge pages. By deploying specialized probe connections across a fraction of verification pages, security systems measured client trust metrics to understand the broader state of client-side patch adoption across the wider Internet.
Ongoing Security Guidance and Next Steps
The eMudhra incident highlights ongoing systemic risks associated with certificate authority cryptographic generation practices and public trust structures. While major service providers have successfully isolated and mitigated vulnerabilities within their perimeter controls, the prolonged exposure of weak intermediate keys underscores the critical importance of robust auditing, transparent cryptographic practices, and rapid automated vulnerability patching.
Organizations operating public-facing infrastructure are advised to review all trusted certificate authorities, enforce strict Certificate Transparency monitoring, and update client trust stores to eliminate vulnerable intermediate keys. Detailed technical findings and continuous updates regarding remediation efforts remain available directly through the official Cloudflare Blog.
Sources
- Cloudflare Blog4 real? Tracking exploitation and patching of eMudhra’s weak keys
Continue chronologically
Related entity coverage
Related stories
Cloudflare Responds After 8 eMudhra Certificates Compromised
Cloudflare deploys mitigations and releases client updates following the discovery that eight eMudhra intermediate certificates use weak keys.
Mozilla, Google, and Apple Block Weak eMudhra Certificates
Major tech vendors including Mozilla, Google, and Apple have blocked eight compromised eMudhra intermediate certificates featuring critically weak private keys.
Cloudflare Launches Origin Range Requests for Large Files
Cloudflare introduces Origin Range Requests to automate partial file fetching, cutting R2 p99 latency and improving cache efficiency.
Cloudflare Reclaims 100TB of RAM With Math and Rust
Cloudflare says a statistical redesign of consistent hashing cut more than 100TB of RAM from a Pingora-based service across its global network.
