Brief
Cloudflare patches services after eight eMudhra certificates compromised
The incident affects widely trusted certificates and prompted immediate updates to Cloudflare's CDN, Zero Trust and client apps.
By Felo News Desk · Published
On Oct. 19, 2026, at about 17:00 UTC, Cloudflare detected that private keys for eight eMudhra intermediate certificates had been compromised, according to the company's blog.
What happened
The compromised certificates are used by browsers, operating systems and Cloudflare services. Because the keys are weak, an attacker could forge certificates for any domain and impersonate servers, potentially intercepting or altering traffic.
What the reports add
Cloudflare said it prioritized patching critical services before publicly disclosing the vulnerability. The company reported no evidence of active exploitation on its own infrastructure. Updates were released for Cloudflare One (WARP) clients, the 1.1.1.1 app, and Cloudflare Tunnel (cloudflared). Mitigations were also deployed across the CDN, Developer and Zero Trust products, with automatic protection for customers using up‑to‑date Zero Trust Gateway clients.
What was said
Cloudflare’s blog stated, "We immediately prioritized patching critical services across Cloudflare to protect our customers ahead of the public disclosure of the vulnerability." It added, "Our security review has not identified active exploitation of this issue on Cloudflare services." The post also warned that some customers may need to adjust software or trust configurations on their own origin servers.
How it came about
The breach stems from the weakness of the eMudhra intermediate certificate keys, which allowed the creation of forged certificates. Cloudflare responded by updating shared trust stores, base images and other foundations that services inherit, followed by reloads, restarts and image deployments. The company noted that the work addresses certificate‑based authentication rather than a flaw in TLS encryption itself, and that remediation efforts are ongoing.
Recommended customer actions
Customers using Cloudflare One/WARP should upgrade to the latest client versions (v2.5.6 for Android, v1.12.16 for iOS, and 2026.8.2115.0 for desktop platforms). Users of the 1.1.1.1 app should upgrade to v6.38.10 (Android), v6.31.7 (iOS) or the same desktop version. The blog provides a table of required upgrades for each platform.
Key facts
- Compromise of eight eMudhra intermediate certificate private keys was detected on Oct. 19, 2026 at 17:00 UTC. (blog.cloudflare.com)
- Cloudflare released updates for Cloudflare One, 1.1.1.1 app and Cloudflare Tunnel to mitigate the risk. (blog.cloudflare.com)
- No active exploitation of the compromised certificates was found on Cloudflare services. (blog.cloudflare.com)
- Customers are advised to upgrade to specific client versions listed in the blog post. (blog.cloudflare.com)
Sources
- [1] blog.cloudflare.com — originally reported as “8 eMudhra certificates are compromised. Here's what you need to know”
