CLOUDFLARE says private keys for eight eMudhra intermediate certificates were compromised, leaving certificates trusted by browsers, operating systems and Cloudflare vulnerable to abuse. The company says the keys are weak enough that an attacker could create a forged certificate for any domain, potentially impersonating servers and intercepting or altering traffic. Cloudflare became aware of the compromise at about 17:00 UTC on 19 October 2026.
Its review has not found active exploitation on Cloudflare services; the company describes the risk, rather than exploitation in the wild, as the confirmed concern.
Cloudflare says it prioritised updates to services that use certificates to authenticate remote systems, as well as shared trust stores, base images and other infrastructure. It published updates for Cloudflare One/WARP and the 1.1.1.1 app on 20 October, and for Cloudflare Tunnel (cloudflared) later that day; CDN and server-side Zero Trust mitigations were fully deployed by 19:20 UTC.
Customers should upgrade WARP and 1.1.1.1 clients to the platform-specific versions listed by Cloudflare, and cloudflared to 2026.10.2. Those using customer-configured mutual TLS should review their trusted certificate authorities, while customers using strict origin TLS should check custom origin certificates and server settings.
Cloudflare warns that some customers must also update software or trust configurations they manage, particularly on origin servers and in container images. Developers should check the actual certificate-verification path used by their applications, including underlying libraries, runtimes and custom trust stores. The company cautions against disabling certificate verification to resolve errors after updates, as this would remove the authentication protection the changes are intended to restore.