8 eMudhra certificates are compromised. Here's what you need to know
- ID
- 37617
- Status
- summarized
- Published
- 21 Oct 2026, 6:20 AM
- Fetched
- 21 Oct 2026, 6:58 AM
- Provider
- Cloudflare Blog
- Category
- infrastructure
- Original URL
- https://blog.cloudflare.com/emudhra-certificate-compromise/
- Source URL
- https://blog.cloudflare.com/rss/
Summary
- Score
- 7.5
- Created
- 21 Oct 2026, 6:58 AM
- Tags
- Audience
- developersvibe_coderssaas_startup_founders
What happened
On October 19, 2026 at about 17:00 UTC, Cloudflare learned that private keys for eight eMudhra intermediate certificates were compromised; because the keys are weak, an attacker could forge certificates for any domain and impersonate servers. Cloudflare says it has not found active exploitation on its services and has shipped fixes for Cloudflare One/WARP, the 1.1.1.1 app, and cloudflared, but customers still need to update origin servers and custom trust stores.
Why it matters
If you run Cloudflare Tunnel/cloudflared or Cloudflare One/WARP, upgrade to the listed versions (cloudflared 2026.10.2; Windows/macOS/Linux 2026.8.2115.0; Android/iOS app-specific versions) and check origin servers with bundled or custom trust stores. Zero Trust Gateway users with an up-to-date client are automatically protected, but that does not cover your own trust configurations.
Discussion angle
How would you inventory every place your apps trust a CA—origin servers, base images, bundled trust stores, and CI runners—so a CA compromise like this becomes a checklist rather than a scramble?