On October 19, 2026, Cloudflare became aware that private keys associated with eight eMudhra intermediate certificates had been compromised. The certificates were trusted by browsers, operating systems and Cloudflare. Because the keys are weak, an attacker could create a forged certificate for any domain and use it to impersonate servers, intercept traffic or modify it.
This is not a reported weakness in TLS encryption itself. It is a problem with certificate-based authentication: software may trust a certificate that should no longer be trusted. Cloudflare says its review has not identified active exploitation on its services, but the incident has implications across the Internet. Read Cloudflare’s incident report and recommendations.
For a business, the practical issue is that updating one visible app may not update every service that checks certificates. Software can rely on a library, language runtime, operating system or custom trust configuration. Owners should identify which systems they use, apply relevant updates and verify the actual connections their applications make.
What the certificate compromise means
A certificate helps a client verify the identity of the server it is connecting to. If a trusted certificate authority’s compromised key is used to create a forged certificate, a client that still trusts it could mistake an attacker-controlled server for the real one. That can put traffic at risk of interception or modification.
The affected certificates were intermediate certificates, and Cloudflare describes them as widely trusted. The company says it prioritized patching critical services before public disclosure. It updated shared trust stores and foundations, as well as services using public certificates to authenticate remote endpoints. It also assessed applications with bundled or custom trust stores separately.
For owners, that distinction matters. Updating your website’s visible pages is not necessarily the same as updating the software that checks certificates when it connects to an API, an origin server or another service. If you operate an online store, customer portal or business application, review the systems and dependencies behind it as well as the public-facing site. Our website development work and app development services cover these kinds of connected digital products, but the security checks should be made by the people responsible for your deployed software and configuration.
Check your Cloudflare services and configurations
Cloudflare says it deployed mitigations across its CDN, Developer and Zero Trust products. Customers using Cloudflare Zero Trust with Gateway and an up-to-date client are automatically protected. Some customers still need to act, especially on software or trust configurations they operate themselves, including origin servers.
Use Cloudflare’s recommendations as a checklist for the services you actually use:
- Cloudflare One Client or WARP: upgrade to the version listed for your platform in Cloudflare’s report. The listed versions include v2.5.7 for Android, v1.12.7 for iOS, and 2026.8.2115.0 for Windows, macOS and Linux.
- The 1.1.1.1 app: upgrade to v6.38.11 for Android, v6.31.8 for iOS, or 2026.8.2115.0 for Windows, macOS and Linux.
- Cloudflare Tunnel, also called cloudflared: upgrade to 2026.10.2. If you use a container deployment, update and redeploy the fixed image.
- Customer-configured TLS client authentication: review and update the mutual TLS trust store or uploaded certificate authorities used to verify client certificates.
- Origin TLS: review custom origin certificates and server configurations if you use Full (strict) or Strict mode.
- Cloudflare Containers, including Sandboxes: check container images and application dependencies for affected certificate trust stores, then apply updates for your deployed image.
Use the exact platform versions and instructions in Cloudflare’s report when making changes. Cloudflare also says Automatic SSL/TLS is being updated to notify customers if they still use distrusted certificates, which could cause breakages. A notification is useful, but it does not replace checking configurations and software that your team manages.
Look beyond the app you can see
An application may delegate certificate verification to an HTTP library, a language runtime, the operating system or a custom trust configuration. Updating an SDK alone may not change the policy used to verify a certificate. That is why teams should inspect dependencies and the route each application uses to validate certificates.
Cloudflare points to a crowdsourced list of commonly used packages that have been patched and advises upgrading relevant dependencies. Some affected packages may be indirect dependencies, so check your software’s dependency tree. Then rebuild affected images and confirm whether applications need a reload, restart or redeployment for changes to take effect.
Testing should follow the same principle. Cloudflare notes that browser checks, non-browser tests and package information can help, but a result only applies to the verification path tested. A successful browser test does not prove that a background service is protected. Nor does a curl test prove safety if your application uses a different verifier.
For a business with an online store, that means checking the services that handle the store’s actual connections, not just opening its home page in a browser. The same applies to a customer portal or another product that calls external APIs. If you are planning or reviewing a store built for online sales, include its application dependencies and deployed images in the security review.
Avoid a quick fix that removes protection
After patching, you may see certificate errors in dashboards. Do not resolve them by disabling certificate verification. Cloudflare warns that doing so removes the authentication protection these updates are intended to restore.
Treat an error as a reason to investigate the certificate and trust configuration. Confirm that the relevant software and dependencies are updated, and that any required reload, restart or redeployment has happened. If your team cannot establish which component performs certificate verification, involve the person or provider responsible for that application rather than switching verification off.
Cloudflare has also described HTTPS egress interception as an option for Cloudflare Containers. It routes outbound HTTPS requests through Cloudflare so certificate validation moves from the application to Cloudflare-managed infrastructure. Cloudflare says containers with this enabled are already protected by its trust-store mitigations. Consider this only in the context of your deployment and configuration; it does not remove the need to review other affected systems.
What to do next
Work through these steps with whoever maintains your website, applications, infrastructure or managed services:
- Make an inventory. List the Cloudflare products you use, your origin servers, container deployments, API clients and applications that connect to external services. Include software that runs in the background, not only tools employees open directly.
- Match each system to Cloudflare’s guidance. Check the relevant client, tunnel, TLS client authentication, origin TLS or container recommendations. Upgrade the specified software where it applies.
- Review dependencies and trust stores. Check direct and indirect packages, operating-system trust stores and any custom or bundled certificate authorities. Update the affected components and rebuild images where needed.
- Activate the changes. Confirm whether updated applications need a reload, restart or redeployment. Do not assume installing an update has activated it everywhere.
- Test the real connection path. Verify the applications and services that make the connections. A browser result alone is not evidence that an API client or background service uses the same verification path.
- Keep certificate verification enabled. Investigate errors rather than disabling checks. Record which systems have been reviewed and which still need attention.
Cloudflare says remediation work is continuing and that customers may need to update software or trust configurations they operate. A careful review now can help your team identify where certificate validation happens and whether the relevant fix has reached the systems that rely on it.
Sources
- 8 eMudhra certificates are compromised. Here's what you need to know — Cloudflare Blog, Oct 20, 2026
This article was drafted with AI from the sources above, then published only after passing 20 automated checks: every figure must appear in the sources, links must work, and nothing may be invented. Spotted an error? Tell us and we'll correct it.
Want us to do this for you?
We help businesses across 3 continents implement everything you just read — and a lot more.