Cloudflare says compromised eMudhra certificate keys pose a broad internet security risk

Cloudflare says private keys tied to eight eMudhra intermediate certificates were compromised, creating a risk that attackers could forge certificates for any domain and impersonate servers. The certificates were trusted by browsers, operating systems and Cloudflare, according to the company. Cloudflare said it became aware of the compromise at about 17:00 UTC on October 19, 2026.

The company said it had not identified active exploitation on Cloudflare services. It has released security updates for Cloudflare One clients, the WARP and 1.1.1.1 apps, and Cloudflare Tunnel, and says it deployed mitigations across its CDN, Developer and Zero Trust products. Cloudflare characterized the issue as a problem with certificate-based authentication, not a flaw in TLS encryption itself.

Cloudflare’s response includes updating shared trust stores and other foundations, as well as patching services that use public certificates to authenticate remote endpoints. It said some applications use bundled or custom trust stores and therefore require separate assessment. The company is continuing remediation and warned that some customers will need to update software or trust configurations they operate, including systems on their origin servers.

Customers using Cloudflare Tunnel should upgrade cloudflared to version 2026.10.2, Cloudflare said. Users of Cloudflare One and WARP should install the listed updates for their platform; customers who configured mutual TLS should review the certificate authorities in their trust stores. Cloudflare also advised customers to review custom origin certificates and server settings when using Full (strict) or Strict mode.

The company urged developers to check the certificate-verification path beneath an SDK: verification may be handled by an HTTP library, language runtime, operating system or custom configuration, so updating an SDK alone may not be enough. It cautioned against resolving new certificate errors by disabling verification, and recommended applying dependency updates, rebuilding affected images and checking whether applications need a restart or redeployment.

Cloudflare’s published timeline says it issued client updates on October 20, with the iOS Cloudflare One Agent update still pending app review at the time of publication. It reported that the cloudflared update was published at 09:15 UTC and CDN and server-side Zero Trust mitigations were fully deployed by 19:20 UTC that day. The company said browsers could respond quickly through revocation mechanisms, while remediation across many software stacks is more involved.