# Eight eMudhra Intermediate Certificates Compromised: Security Alert Cloudflare addresses critical certificate vulnerability impacting global WebPKI infrastructure and server authentication. - **Source:** [Cloudflare Blog](https://blog.cloudflare.com) - **Published:** 2026-10-20 - **Topic:** [Software & Engineering](https://brifing.si/c/engineering) - **Original article:** - **On Brifing:** https://brifing.si/s/5e681348-a885-493d-a835-5aa26cdb0316 ## Compromise of eMudhra Certificates On October 19, 2026, Cloudflare identified that private keys for eight eMudhra intermediate certificates were compromised. These certificates, widely trusted by browsers and operating systems, possessed weak keys. This vulnerability allows attackers to forge certificates for any domain, potentially enabling traffic interception or server impersonation across the entire internet. ## Immediate Cloudflare Response Actions Cloudflare prioritized patching critical services before the public disclosure of the vulnerability. Security teams updated Cloudflare One Clients, including WARP and the 1.1.1.1 app, alongside Cloudflare Tunnel. Mitigations were deployed across CDN, Developer, and Zero Trust products to ensure that customers using Gateway with updated clients remain protected from potential exploitation. ## Authentication and Trust Store Updates The response focused on services using public certificates to authenticate remote endpoints, such as proxies and API callers. Engineers updated shared trust stores and base images to provide a common mitigation path. These updates required reloads, restarts, and image deployments to activate, specifically addressing certificate-based authentication rather than TLS encryption algorithm weaknesses. ## Developer Guidance for Remediation Developers must look beyond SDKs, as API clients often delegate verification to HTTP libraries, language runtimes, or custom trust configurations. Simply updating the SDK may not alter the underlying policy. It is critical to avoid disabling verification when certificate errors appear in dashboards, as this removes the essential authentication protection provided by updates. ## Managing Software Stack Dependencies This incident impacts numerous software stacks relying on WebPKI for authentication. Developers should consult the crowdsourced list of patched packages maintained by Mozilla’s Dennis Jackson. It is vital to inspect dependency trees, as affected packages may be indirect dependencies. After applying updates, teams must rebuild images and confirm if applications require restarts. ## Validation of Security Measures Testing must occur through the application’s actual TLS path to ensure efficacy. A successful browser test does not guarantee that background services are protected, nor does a curl test if the application utilizes a different verifier. Dennis Jackson’s test site provides instructions, but results are specific to the verification path being tested. ## Incident Timeline and Deployment Cloudflare became aware of the issue at 17:00 UTC on October 19. By 02:00 UTC on October 20, security updates for Cloudflare One Client and WARP were published. Cloudflare Tunnel updates followed at 09:15 UTC, and by 19:20 UTC, CDN and server-side Zero Trust mitigations were fully deployed across the global network. ## Future Trust Store Management The incident highlights the limitations of static root certificate authority lists. While browsers utilize quick-revocation mechanisms like Chrome CRLSets, broader systems require more agility. Cloudflare is exploring projects like upki to enable faster updates for revocation and certificate transparency keys, aiming to move beyond static trust stores for improved industry-wide security. ## Sources covering this story - https://blog.cloudflare.com/emudhra-certificate-compromise/ — --- _Summary written by Brifing from the original reporting. Copyright in the original article belongs to its publisher; read the full piece at the link above._