8 eMudhra certificates are compromised. Here's what you need to know
Compromised private keys for 8 widely-trusted eMudhra certificates let attackers forge certs for any domain to intercept traffic.
Cloudflare disclosed that private keys for eight eMudhra intermediate certificates, widely trusted by browsers, operating systems and Cloudflare itself, were compromised on October 19, 2026. Because the keys are weak, an attacker could forge valid certificates for any domain to intercept or modify TLS traffic. Cloudflare has patched its WARP/1.1.1.1 clients and cloudflared, deployed mitigations across its CDN and Zero Trust products, and is urging customers using custom trust stores, mTLS, or strict origin TLS modes to review and update their configurations.
Why it matters
A compromised certificate authority's private keys undermine the core trust mechanism of the web: any attacker holding the keys can impersonate any HTTPS site to intercept or tamper with traffic, and remediation requires patching across browsers, OSes, proxies, and countless software stacks that embed trust stores rather than a single vendor fix.
What is verified
Private keys associated with eight eMudhra intermediate certificates were compromised, discovered by Cloudflare on October 19, 2026 at approximately 17:00 UTC. [1]
These certificates were widely trusted by browsers, operating systems, and within Cloudflare, and because the keys are weak an attacker can forge a certificate for any domain to impersonate servers and intercept or modify traffic. [1]
Cloudflare released security updates for Cloudflare One Clients (WARP/1.1.1.1 app) across Android, iOS, Windows, macOS and Linux, and for Cloudflare Tunnel (cloudflared, update to version 2026.10.2), and deployed mitigations across its CDN, Developer and Zero Trust products. [1]
Cloudflare's security review had not identified active exploitation of this issue on Cloudflare services as of the post. [1]
Cloudflare advises customers using Full (strict) or Strict origin TLS modes, custom trust stores, mTLS configurations, and Cloudflare Containers to review and update their certificate trust configurations, and warns against disabling certificate verification to resolve resulting errors. [1]
What is not
- The evidence does not name eMudhra as a root CA's ownership structure or scope of its certificate issuance outside Cloudflare's own ecosystem.
- It is not stated how the private keys were compromised (e.g., breach, leak, weak key generation) beyond the keys being described as 'weak'.
- No figures are given for how many websites, devices, or organizations beyond Cloudflare's own customer base are affected industry-wide.
- The full extent of required remediation outside Cloudflare's own products (e.g., other vendors, other CDNs, enterprise software using eMudhra certs) is not detailed in this source.
Sources
- 1Cloudflare Blogblog.cloudflare.com · Primary source
Original source published 21 October 2026 at 00:20.
An AI-assisted briefing by Coding Partners. We link the evidence behind the reporting so you can explore the original work and assess the claims. How CP Signal works.