Cloudflare Responds After 8 eMudhra Certificates Compromised
Cloudflare has mobilized mitigations and rolled out critical client updates following the discovery that private keys associated with eight eMudhra intermediate certificates are compromised.
Radwan AbdulhadiEditor and technology writer
Incident Overview and Discovery
On October 19, 2026, at approximately 17:00 UTC, Cloudflare became aware that private keys associated with eight eMudhra intermediate certificates were compromised. These certificates were widely trusted by browsers, operating systems, and also within Cloudflare. Because the keys themselves are weak, an attacker can create a forged certificate for any domain and use it to impersonate servers to intercept or modify traffic. This is a serious security incident with implications across the Internet. For reference, here is a link to more information about how SSL certificates work and why they are so critical to the operation of the Internet.
Cloudflare immediately prioritized patching critical services across its infrastructure to protect customers ahead of the public disclosure of the vulnerability. The company's security review has not identified active exploitation of this issue on Cloudflare services, but the broader industry impact remains significant.
Cloudflare Mitigations and Client Updates
In response to the compromise, Cloudflare released updates for the Cloudflare One Clients, also known as WARP or the 1.1.1.1 app, and Cloudflare Tunnel, also known as cloudflared. Mitigations have also been deployed across CDN, Developer, and Zero Trust products. Customers utilizing Cloudflare Zero Trust with Gateway alongside an up-to-date client are automatically protected.
Services that use public certificates to authenticate remote endpoints—including proxies connecting to origins and applications calling external APIs—were prioritized. Shared trust stores, base images, and other shared foundations were updated simultaneously to provide a common mitigation path for services inheriting certificate trust from those sources.
Action Required for Customers and Developers
Teams across Cloudflare are working on further remediation, but customers must also take action on software and trust configurations they operate, particularly on origin servers. For those utilizing Cloudflare One Clients or the 1.1.1.1 app, recommended updates include specific versions across Android and iOS, as well as Linux. For Linux environments, users can utilize resources like Linux (2026.8.2115.0) to maintain up-to-date deployments.
Customers using Cloudflare Containers, including Sandboxes, should review container images and application dependencies for affected certificate trust stores and apply updates based on their deployed image. Additionally, developers utilizing tunneling software should ensure they apply the correct version updates, such as an Upgrade to 2026.10.2 for cloudflared.
Configuration Guidance and Ecosystem Impact
Customers can also enable HTTPS egress interception to route outbound HTTPS requests through Cloudflare, moving remote-server certificate validation from the application to Cloudflare-managed infrastructure. This allows Cloudflare's trust-store mitigations to protect intercepted connections, and containers with this enabled are already protected. API clients may delegate certificate verification to an HTTP library, a language runtime, the operating system, or a custom trust configuration, meaning updating the SDK alone may not change the underlying policy.
Once patched, users may notice certificate errors in their dashboards. It is important not to resolve these errors by disabling verification, as doing so would remove the authentication protection these updates are intended to restore. Because this incident affects many software stacks relying on the WebPKI, Mozilla’s Dennis Jackson has crowdsourced a list of commonly used packages that have been patched, and readers are advised to upgrade as soon as possible.
Industry Response and Future Trust Models
The impact of this incident is not felt equally across all software providers. Browser maintainers were able to remediate the issue quickly because they manage single applications and utilize quick-revocation mechanisms like Chrome CRLSets. Cloudflare employs similar mechanisms for select products, but industry leaders are pushing for broader architectural improvements.
To bring rapid revocation and update capabilities to more systems across Cloudflare and the wider industry, developers are expressing excitement for projects like upki that recognize a trust store cannot remain a static list of root certificate authorities, but must feature the ability to be quickly updated with revocation and certificate transparency information.
Sources
- Cloudflare Blog8 eMudhra certificates are compromised. Here's what you need to know
Continue chronologically
Related entity coverage
Related stories
Tracking Exploitation and Patching of eMudhra’s Weak Keys
An in-depth look at how Cloudflare tracked exploitation attempts, analyzed source code using AI, and patched eMudhra's unprecedentedly weak certificate keys.
Mozilla, Google, and Apple Block Weak eMudhra Certificates
Major tech vendors including Mozilla, Google, and Apple have blocked eight compromised eMudhra intermediate certificates featuring critically weak private keys.
Microsoft Issues OOB Windows Updates to Untrust eMudhra
Microsoft releases out-of-band Windows updates to remove trust in certificates tied to compromised eMudhra keys for offline and restricted systems.
Cloudflare Announces Intent to Become a Public Certificate Authority
Cloudflare is applying to become a public certificate authority, combining an established root, an ACME-first approach, and Merkle Tree Certificates.
