eMudhra Certificate Compromise Affects Internet Trust

What happened

On October 19, 2026 at 17:00 UTC, Cloudflare discovered that private keys associated with eight eMudhra intermediate certificates had been compromised. eMudhra certificates are widely trusted by browsers, operating systems, and within Cloudflare's infrastructure. Because the underlying keys are weak, attackers could create forged certificates for any domain and use them to impersonate servers, potentially intercepting or modifying traffic across the internet.

Cloudflare's security review found no evidence of active exploitation of this issue on its own services. The company prioritized patching critical infrastructure ahead of public disclosure to protect customers.

Cloudflare's response

Cloudflare deployed updates across multiple products and services. The company released security updates for Cloudflare One Clients (WARP) and the 1.1.1.1 app across Android, iOS, Windows Desktop, macOS, and Linux. Cloudflare Tunnel (cloudflared) was updated to version 2026.10.2.

Mitigations were deployed across Cloudflare's CDN, Developer, and Zero Trust products. Cloudflare prioritized updating services that authenticate remote endpoints using public certificates, including proxies connecting to origins and applications calling external APIs. The company updated shared trust stores and base images to provide a common mitigation path.

Customers using Cloudflare Zero Trust with Gateway and an up-to-date client are automatically protected. However, the company notes that further remediation work is ongoing, and some customers will need to take additional action on their own systems, particularly on origin servers.

What customers need to do

Customers using Cloudflare products must upgrade to specific versions. For Cloudflare One Client, upgrades include v2.5.6 (Android), v1.12.16 (iOS), Windows Desktop 2026.8.2115.0, macOS 2026.8.2115.0, and Linux 2026.8.2115.0. The 1.1.1.1 app requires v6.38.10 (Android), v6.31.7 (iOS), and Desktop 2026.8.2115.0 across Windows, macOS, and Linux. Cloudflare Tunnel users must upgrade to version 2026.10.2, and container deployments must update and redeploy the fixed image.

Beyond Cloudflare products, customers need to review their own TLS configurations. Those using customer-configured TLS client authentication should review and update their mutual TLS trust stores and uploaded CAs used to verify client certificates. Customers using Cloudflare's Full (strict) or Strict encryption modes should review custom origin certificates and server configurations. Customers using Cloudflare Containers or Sandboxes should review container images and dependencies for affected certificate trust stores and apply updates.

Cloudflare will update its Automatic SSL/TLS feature to automatically notify customers if they still use distrusted certificates, which could cause service breakages. Customers can also enable HTTPS egress interception to route outbound HTTPS requests through Cloudflare, moving certificate validation to Cloudflare's managed infrastructure.

Developer guidance

Developers must understand that updating an SDK alone may not resolve the issue, because certificate verification can be delegated to an HTTP library, language runtime, operating system, or custom configuration. Developers should look at the entire verification chain and apply dependency updates across the stack, rebuild affected images, and confirm whether applications require a reload, restart, or redeployment.

Once patched, developers may notice certificate errors in dashboards or applications. It is critical not to resolve these errors by disabling verification, as that would remove the authentication protection the updates are designed to restore. Mozilla's Dennis Jackson has crowdsourced a list of commonly used packages that have been patched. Developers should upgrade affected dependencies as soon as possible, checking indirect dependencies in the dependency tree.

Validation should occur through each application's actual TLS path. Browser tests and curl tests may not reflect the certificate verification behavior of background services or other applications on the device.

Source

AI-assisted, verified against the source. This post was drafted with AI from the primary source linked above and checked automatically against it. For anything you depend on, read the original.