Skip to content
OriginalSign in
Image: Cloudflare

CloudflareMaxime Guerreiro

Cloudflare finds weak eMudhra keys exposed TLS connections

Part of the eMudhra story · since 20 Oct

Developinglatest 1 hour ago21 articles10 outlets
20 Oct · The Hacker News first27 Oct29 OctNowThis article21st of 21
  • Tue 20 Oct, 12:31 UTC. The Hacker News, first report. Go Blocks Eight eMudhra Certificate Keys in Emergency Update.
  • Tue 20 Oct, 18:35 UTC. The Hacker News. Browsers Block Eight Compromised eMudhra Certificate Authority Keys.
  • Tue 20 Oct, 20:21 UTC. Ars Technica, its first report on the story. Browsers block eight eMudhra certificates after weak keys risk trusted forgeries.
  • Tue 20 Oct, 22:30 UTC. Dark Reading, its first report on the story. Tech Giants Block Eight eMudhra Keys After Compromise Exposed.
  • Tue 20 Oct, 22:31 UTC. Cloudflare, its first report on the story. Cloudflare Warns Compromised Certificate Keys Could Enable Server Impersonation.
  • Wed 21 Oct, 02:31 UTC. SANS ISC, its first report on the story. eMudhra Revokes Eight CAs After Private Keys Were Created One Byte Long.
  • Wed 21 Oct, 03:01 UTC. SecurityOnline, its first report on the story. Mozilla Blocks Weak eMudhra Keys That Could Enable Website Impersonation.
  • Wed 21 Oct, 11:38 UTC. SecurityWeek, its first report on the story. Weak eMudhra keys let attackers forge trusted HTTPS certificates.
  • Wed 21 Oct, 14:46 UTC. SOCRadar, its first report on the story. Weak eMudhra CA Keys Let Attackers Forge Trusted TLS Certificates.
  • Thu 22 Oct, 17:48 UTC. Unit 42, its first report on the story. Weak randomness exposes eMudhra certificate keys, enabling TLS attacks.
  • Thu 22 Oct, 18:23 UTC. The Hacker News. eMudhra Exits SSL Business After Private Keys Are Recovered.
  • Thu 22 Oct, 20:12 UTC. StepSecurity, its first report on the story. Python Urges Users to Update Tools After CA Key Compromise Threat.
  • Thu 22 Oct, 20:48 UTC. Ars Technica. eMudhra Exits Global TLS Market After Eight Weak Keys Were Issued.
  • Fri 23 Oct, 04:30 UTC. SecurityOnline. Oracle Rushes Fix for Compromised Certificates Threatening Java Users.
  • Mon 26 Oct, 03:19 UTC. SecurityOnline. eMudhra faces backlash over delayed certificate disclosures.
  • Mon 26 Oct, 07:30 UTC. SecurityOnline. Weak eMudhra Keys Enable Thousands of Rogue Certificates.
  • Tue 27 Oct, 02:01 UTC. SecurityOnline. Apple Blocks Compromised eMudhra Certificates Across Its Devices.
  • Tue 27 Oct, 13:55 UTC. Cloudflare. Cloudflare launches PHP hacking challenge after php2shell flaws. Cites a CVE in CISA KEV.
  • Wed 28 Oct, 04:01 UTC. SANS ISC. eMudhra certificate compromise triggers revocations and system updates.
  • Thu 29 Oct, 10:31 UTC. SecurityOnline. Cloudflare updates cloudflared to block forged certificates.
  • Fri 30 Oct, 18:30 UTC. Cloudflare. Cloudflare finds weak eMudhra keys exposed TLS connections. This article, 21st of 21.

Cloudflare says it discovered on 19 October 2026 that eight eMudhra intermediate certificate-authority keys were derived from extremely weak numbers: 4, 56, 66, 115, 155, 156, 230 and 237. Anyone could recover the private signing keys from the public certificates and issue certificates for any domain.

Unpatched clients that did not enforce Certificate Transparency could accept them. eMudhra has said a mistake in a key-generation script was responsible and announced it would leave the public CA business, but has not shared the script.

Cloudflare says all its high-priority systems have been patched. Its monitoring recorded about 22,000 attempted TLS handshakes using the weak keys in the week after deployment; all attempts that checked certificates were rejected. Around 160 certificates named domains unrelated to the requested connection, including some associated with consumer IoT devices. Cloudflare said these appeared to be servers’ own default certificates, not evidence of interception, and it has found no signs of targeted interception. However, one forged certificate was dated 20 October at 18:19 UTC, less than an hour after Mozilla’s public disclosure.

To estimate exposure among visitors, Cloudflare ran certificate probes on a sample of challenge pages, gathering 50 million results over a week. It found that modern browsers were mostly patched, but old browsers and embedded browsers such as Android WebView lagged, with 30–40% still accepting the weak chain. More than half of probes on large networks continued to accept it.

Cloudflare cautioned that the sample was skewed by bots and changing traffic classifications, so the results are suggestive rather than conclusive. It urged users to patch and pointed Cloudflare customers to guidance for products including WARP and Tunnel.

How the story developed

All 21 articles
Developinglatest 1 hour ago21 articles10 outlets

21 articles from 10 outlets since 20 Oct. Still developing; the latest report was 1 hour ago. This was the 21st report, 10 days after the first.

Now20 Oct222327282930First reportThe Hacker News · 20 Oct, 12:31This article21st of 21 · day 10Exploited CVECloudflare · 27 Oct
  • Tue 20 Oct, 12:31 UTC. The Hacker News, first report. Go Blocks Eight eMudhra Certificate Keys in Emergency Update.
  • Tue 20 Oct, 18:35 UTC. The Hacker News. Browsers Block Eight Compromised eMudhra Certificate Authority Keys.
  • Tue 20 Oct, 20:21 UTC. Ars Technica, its first report on the story. Browsers block eight eMudhra certificates after weak keys risk trusted forgeries.
  • Tue 20 Oct, 22:30 UTC. Dark Reading, its first report on the story. Tech Giants Block Eight eMudhra Keys After Compromise Exposed.
  • Tue 20 Oct, 22:31 UTC. Cloudflare, its first report on the story. Cloudflare Warns Compromised Certificate Keys Could Enable Server Impersonation.
  • Wed 21 Oct, 02:31 UTC. SANS ISC, its first report on the story. eMudhra Revokes Eight CAs After Private Keys Were Created One Byte Long.
  • Wed 21 Oct, 03:01 UTC. SecurityOnline, its first report on the story. Mozilla Blocks Weak eMudhra Keys That Could Enable Website Impersonation.
  • Wed 21 Oct, 11:38 UTC. SecurityWeek, its first report on the story. Weak eMudhra keys let attackers forge trusted HTTPS certificates.
  • Wed 21 Oct, 14:46 UTC. SOCRadar, its first report on the story. Weak eMudhra CA Keys Let Attackers Forge Trusted TLS Certificates.
  • Thu 22 Oct, 17:48 UTC. Unit 42, its first report on the story. Weak randomness exposes eMudhra certificate keys, enabling TLS attacks.
  • Thu 22 Oct, 18:23 UTC. The Hacker News. eMudhra Exits SSL Business After Private Keys Are Recovered.
  • Thu 22 Oct, 20:12 UTC. StepSecurity, its first report on the story. Python Urges Users to Update Tools After CA Key Compromise Threat.
  • Thu 22 Oct, 20:48 UTC. Ars Technica. eMudhra Exits Global TLS Market After Eight Weak Keys Were Issued.
  • Fri 23 Oct, 04:30 UTC. SecurityOnline. Oracle Rushes Fix for Compromised Certificates Threatening Java Users.
  • Mon 26 Oct, 03:19 UTC. SecurityOnline. eMudhra faces backlash over delayed certificate disclosures.
  • Mon 26 Oct, 07:30 UTC. SecurityOnline. Weak eMudhra Keys Enable Thousands of Rogue Certificates.
  • Tue 27 Oct, 02:01 UTC. SecurityOnline. Apple Blocks Compromised eMudhra Certificates Across Its Devices.
  • Tue 27 Oct, 13:55 UTC. Cloudflare. Cloudflare launches PHP hacking challenge after php2shell flaws. Cites a CVE in CISA KEV.
  • Wed 28 Oct, 04:01 UTC. SANS ISC. eMudhra certificate compromise triggers revocations and system updates.
  • Thu 29 Oct, 10:31 UTC. SecurityOnline. Cloudflare updates cloudflared to block forged certificates.
  • Fri 30 Oct, 18:30 UTC. Cloudflare. Cloudflare finds weak eMudhra keys exposed TLS connections. This article, 21st of 21.
  • Known exploited CVE
  • CVE not in KEV
  • No CVE
  • Larger: an outlet’s first report
  • Coverage over time
  • Quiet time, folded
Show all 21 articles as a list
  1. Tue 20 OctDay 05
    1. Go Blocks Eight eMudhra Certificate Keys in Emergency Update12:31 · The Hacker News · First report
    2. Browsers Block Eight Compromised eMudhra Certificate Authority Keys18:35 · The Hacker News
    3. Browsers block eight eMudhra certificates after weak keys risk trusted forgeries20:21 · Ars Technica
    Show 2 more from 20 Oct
    1. Tech Giants Block Eight eMudhra Keys After Compromise Exposed22:30 · Dark Reading
    2. Cloudflare Warns Compromised Certificate Keys Could Enable Server Impersonation22:31 · Cloudflare
  2. Wed 21 OctDay 14
    1. eMudhra Revokes Eight CAs After Private Keys Were Created One Byte Long02:31 · SANS ISC
    2. Mozilla Blocks Weak eMudhra Keys That Could Enable Website Impersonation03:01 · SecurityOnline
    3. Weak eMudhra keys let attackers forge trusted HTTPS certificates11:38 · SecurityWeek
    4. Weak eMudhra CA Keys Let Attackers Forge Trusted TLS Certificates14:46 · SOCRadar
  3. Thu 22 OctDay 24
    1. Weak randomness exposes eMudhra certificate keys, enabling TLS attacks17:48 · Unit 42
    2. eMudhra Exits SSL Business After Private Keys Are Recovered18:23 · The Hacker News
    3. Python Urges Users to Update Tools After CA Key Compromise Threat20:12 · StepSecurity
    4. eMudhra Exits Global TLS Market After Eight Weak Keys Were Issued20:48 · Ars Technica
  4. Fri 23 OctDay 31
    1. Oracle Rushes Fix for Compromised Certificates Threatening Java Users04:30 · SecurityOnline

  5. Quiet for 3 days

    Mon 26 OctDay 62
    1. eMudhra faces backlash over delayed certificate disclosures03:19 · SecurityOnline · Picked up again
    2. Weak eMudhra Keys Enable Thousands of Rogue Certificates07:30 · SecurityOnline
  6. Tue 27 OctDay 72
    1. Apple Blocks Compromised eMudhra Certificates Across Its Devices02:01 · SecurityOnline
    2. Cloudflare launches PHP hacking challenge after php2shell flaws13:55 · Cloudflare · Exploited CVE · Known exploited CVE
  7. Wed 28 OctDay 81
    1. eMudhra certificate compromise triggers revocations and system updates04:01 · SANS ISC
  8. Thu 29 OctDay 91
    1. Cloudflare updates cloudflared to block forged certificates10:31 · SecurityOnline
  9. Fri 30 OctDay 101
    1. Cloudflare finds weak eMudhra keys exposed TLS connections18:30 · Cloudflare · This article, 21st of 21

Sources

CyberSIXTSignal over noise
Updated AboutDevelopersSign in