8 eMudhra Certificates Compromised: What You Need to Know

Overview of the Incident

On October 19, 2026, at approximately 17:00 UTC, Cloudflare became aware that private keys associated with eight eMudhra intermediate certificates were compromised. These certificates were widely trusted by browsers, operating systems, and within Cloudflare. According to Cloudflare, the keys themselves are weak, which allows an attacker to create a forged certificate for any domain and use it to impersonate servers to intercept or modify traffic. This security incident has implications across the entire Internet.

Cloudflare Internal Mitigations and Response

Cloudflare prioritized patching critical services across its infrastructure ahead of the public disclosure of the vulnerability. A security review by Cloudflare has not identified active exploitation of this issue on Cloudflare services. Updates have been released for Cloudflare One Clients (also known as WARP or the 1.1.1.1 app) and Cloudflare Tunnel (cloudflared). Mitigations were also deployed across Cloudflare's CDN, Developer, and Zero Trust products. Users of Cloudflare Zero Trust with Gateway and an up-to-date client are automatically protected.

Cloudflare prioritized updating services using public certificates to authenticate remote endpoints, including proxies connecting to origins and applications calling external APIs. Shared trust stores, base images, and other shared foundations were also updated. Cloudflare noted that this work addresses certificate-based authentication rather than a weakness in TLS encryption algorithms.

Recommended Actions for Customers and Developers

Some customers need to take action on software or trust configurations they operate, particularly on origin servers. Recommended software upgrade versions include:

• **Cloudflare One Client:** Upgrade to v2.5.7 (Android), v1.12.7 (iOS), Windows Desktop (2026.8.2115.0), macOS (2026.8.2115.0), and Linux (2026.8.2115.0).

• **1.1.1.1 app:** Upgrade to v6.38.11 (Android), v6.31.8 (iOS), Windows Desktop (2026.8.2115.0), macOS (2026.8.2115.0), and Linux (2026.8.2115.0).

Customers using Cloudflare Containers, including Sandboxes, should review their container images and application dependencies for affected certificate trust stores and apply updates based on their deployed image. Customers can also enable HTTPS egress interception to route outbound HTTPS requests through Cloudflare, allowing Cloudflare-managed infrastructure to handle certificate validation. Developers are advised to look beneath the SDK, as an API client may delegate certificate verification to an HTTP library, a language runtime, the operating system, or a custom trust configuration. Cloudflare emphasizes that after patching, users should not resolve certificate errors by disabling verification, as that removes authentication protection.

Broader Impact and Industry Ecosystem

The incident affects many software stacks relying on the WebPKI for authentication. Mozilla’s Dennis Jackson has crowdsourced a list of commonly used packages that have been patched, and readers are advised to upgrade as soon as possible. Dennis Jackson’s test site provides browser checks, non-browser testing instructions, and package update information. Browser maintainers remediated the issue quickly using quick-revocation mechanisms like Chrome CRLSets. Cloudflare uses similar mechanisms for some products and expressed support for projects like upki to allow trust stores to be quickly updated with revocation and certificate transparency keys.