8 eMudhra certificates are compromised. Here's what you need to know

Cloudflare reported that on October 19, 2026, it learned of compromised private keys for eight widely trusted eMudhra intermediate certificates, a flaw that could enable attackers to forge certificates for arbitrary domains and impersonate servers to intercept or alter traffic. The company said it found no evidence of active exploitation against its services and prioritized mitigations across its CDN, Developer, Zero Trust, Cloudflare One, and Tunnel products, including updates to shared trust stores, base images, and services using public certificates for endpoint authentication. Customers are advised to update WARP, the 1.1.1.1 app, and cloudflared; review mutual TLS trust stores and origin certificate configurations; and patch affected container images, runtimes, libraries, and indirect dependencies. Cloudflare cautioned against disabling certificate verification to address resulting errors and emphasized that testing must reflect each application’s actual TLS verification path. While browsers can often rapidly revoke trust through centralized mechanisms, the incident highlights the broader challenge of updating certificate trust across diverse software stacks and the need for more dynamic trust-store systems.

Use this post, company, and trend context to find content marketing opportunities, perform competitive analysis, or address product feature gaps via the Plushcap MCP server or the Plushcap API.