Cloudflare says private keys for eight eMudhra intermediate certificates were compromised and that the keys are weak, so an attacker could forge a certificate for any domain, and it has shipped client and CDN fixes.
In its incident write-up, Cloudflare says it became aware of the compromise on October 19 at about 17:00 UTC. Browsers, operating systems and Cloudflare itself widely trusted the certificates. Because the keys are weak, Cloudflare says, a forged certificate could be used to impersonate servers and intercept or modify traffic. It says its review has found no active exploitation on Cloudflare services, and that the fix addresses certificate-based authentication, with no weakness in TLS’s encryption algorithms involved.
Client updates went out on October 20 at 02:00 UTC, the cloudflared tunnel update at 09:15 UTC, and CDN and Zero Trust mitigations were fully deployed by 19:20 UTC. Fixed versions include cloudflared 2026.10.2 and desktop client 2026.8.2115.0. The iOS agent update was still in app review.
Customers running their own software have work to do. Cloudflare asks teams using TLS client authentication to review their client-certificate trust store, and teams on Full (strict) origin modes to review custom origin certificates.
Cloudflare says an API client may delegate verification to an HTTP library, a language runtime, the operating system or a custom trust configuration, so updating the SDK alone may not change the underlying policy. It warns against clearing post-patch certificate errors by switching verification off, and says a passing browser test does not prove a background service is protected. Cloudflare points to a crowdsourced list of patched packages and a test site from Mozilla’s Dennis Jackson.
Cloudflare says browser maintainers could respond with a flip of a switch, because most browsers use quick revocation such as Chrome CRLSets and have one application to update instead of hundreds. Start by listing every service that makes outbound HTTPS calls with its own trust store. Related reading: Let’s Encrypt’s move to a 64-day default certificate lifetime and watching Certificate Transparency for every domain you own.
