8 eMudhra certificates are compromised. Here's what you need to know

What it is

Cloudflare's incident post on eight eMudhra intermediate certificates whose private keys were compromised. Cloudflare learned of it around 17:00 UTC on 19 October 2026. The keys are weak, so an attacker can forge a certificate for any domain and impersonate servers to intercept or modify traffic. The post says this is a certificate-authentication failure, not a weakness in TLS encryption algorithms. Cloudflare's review found no active exploitation on its services.

Preconditions / Affected

The certificates were trusted by browsers, operating systems and Cloudflare itself. Any software that verifies server certificates through a trust store containing them is exposed. That includes API clients, background services and proxies connecting to origins.

Cloudflare says customers on Zero Trust with Gateway and an up-to-date client (WARP / 1.1.1.1 app, or cloudflared) are protected automatically. Customers still have to act on software and trust configurations they run themselves, especially origin servers. The post gives no client version numbers.

What to do

• Find which layer does verification. An SDK may delegate to an HTTP library, a language runtime, the OS or a custom trust configuration, so updating the SDK alone may not change the policy.
• Apply dependency updates, including indirect ones, so check the full dependency tree. Dennis Jackson (Mozilla) keeps a crowdsourced list of patched packages.
• Rebuild affected images, and confirm whether each application needs a reload, restart or redeployment before the new trust data takes effect.
• Test the real TLS path with Jackson's test site, which has browser checks, non-browser instructions and package update info. A passing browser test does not cover a background service. A passing curl test does not cover an application that uses a different verifier.
• After patching, certificate errors may appear in dashboards. Do not clear them by disabling verification, because that removes the authentication the update restores.

Caveats

Cloudflare says its own remediation is incomplete, with "much work still to be done". Applications with bundled or custom trust stores needed separate assessment. The post says browsers fixed this quickly through revocation mechanisms such as Chrome CRLSets, while other software lacks an equivalent. It cites upki as a project aimed at that gap. The post's timeline section was not present in the fetched text.