Cloudflare learned on October 19, 2026 that private keys tied to eight eMudhra intermediate certificates were compromised. The issue touches certificates trusted by browsers, operating systems, and Cloudflare, which makes certificate checks part of the response path for some services and customers.
Christopher Patton is one of four authors on the Cloudflare Blog post that described the incident. The post says, “On October 19, 2026, at approximately 17:00 UTC, Cloudflare became aware that private keys associated with eight eMudhra intermediate certificates were compromised.”
Cloudflare One Clients and Tunnel
Cloudflare released updates for Cloudflare One Clients, also known as WARP or the 1.1.1.1 app, and Cloudflare Tunnel, also known as cloudflared. Those updates matter for customers because they tighten the software that checks or carries traffic before it reaches other services.
Cloudflare also deployed mitigations across CDN, Developer, and Zero Trust products. Cloudflare Zero Trust with Gateway and an up-to-date client is automatically protected, which narrows the work for organizations that already keep those components current.
What the compromised keys allow
A private key tied to an intermediate certificate can let an attacker create a forged certificate for any domain and impersonate servers. That gives the attacker a path to intercept or modify traffic, so the incident is about certificate-based trust rather than a weakness in TLS itself.
Cloudflare wrote, “Our security review has not identified active exploitation of this issue on Cloudflare services.” The company still prioritized services that use public certificates to authenticate remote endpoints, including proxies connecting to origins and applications calling external APIs.
Cloudflare Containers and trust stores
Cloudflare updated shared trust stores, base images, and other shared foundations that many deployments reuse. Customers using Cloudflare Containers, including Sandboxes, should review their container images and application dependencies for affected certificate trust stores and apply updates based on the deployed image.
Cloudflare also says customers can enable HTTPS egress interception to route outbound HTTPS requests through Cloudflare. Once patched, certificate errors may appear in dashboards, and customers should not try to clear them by disabling verification.
The source does not identify which eMudhra certificates outside Cloudflare are affected. That leaves the practical work with customers and software operators who need to check their own trust stores, origin-server settings, and container images against the affected certificate chain.
