8 eMudhra certificates are compromised. Here's what you need to know
Cloudflare disclosed a security incident on October 19, 2026, involving compromised private keys for eight eMudhra intermediate certificates, enabling potential forgery of domain certificates and traffic interception.
On October 19, 2026, at approximately 17:00 UTC, Cloudflare identified that private keys tied to eight eMudhra intermediate certificates had been compromised. These certificates were trusted across browsers, operating systems, and Cloudflare’s infrastructure. The weak keys allowed attackers to forge certificates for any domain, enabling server impersonation and traffic interception. Cloudflare immediately began assessing the impact and prioritized patching critical services to protect customers before public disclosure.
Cloudflare released security updates for Cloudflare One Clients (WARP or 1.1.1.1 app) and Cloudflare Tunnel (cloudflared), along with mitigations across CDN, Developer, and Zero Trust products. Customers using Cloudflare Zero Trust with Gateway and updated clients are automatically protected. The company also updated shared trust stores and base images to provide a common mitigation path for services inheriting certificate trust from those sources.
Some customers may need to take additional action on their origin servers or software configurations, particularly those using custom trust stores. Cloudflare recommends reviewing container images and dependencies for affected trust stores and enabling HTTPS egress interception to route outbound HTTPS requests through Cloudflare’s managed infrastructure. Disabling certificate verification to resolve errors is strongly discouraged, as it undermines the intended security updates.
The incident affects many software stacks relying on WebPKI for authentication. Mozilla’s Dennis Jackson has compiled a crowdsourced list of commonly used packages that have been patched. Cloudflare advises upgrading dependencies, rebuilding images, and validating protections through actual TLS paths rather than relying on browser tests or cursory checks. The company continues remediation efforts and emphasizes the need for thorough validation across all applications.