Eight eMudhra certificates compromised; Cloudflare says update cloudflared

Cloudflare said on October 20, 2026 that the private keys for eight eMudhra intermediate certificates had been compromised. These certificates were widely trusted by browsers, operating systems and Cloudflare itself. Because of the weakness, Cloudflare writes, “an attacker can create a forged certificate for any domain” and use it to impersonate servers or intercept traffic. The company says it found no active exploitation on its services, and it has asked customers to update several Cloudflare apps.

What happened

Cloudflare learned of the problem at about 17:00 UTC on October 19. Its timeline:

Time (UTC)	Step
Oct 19, ~17:00	Cloudflare becomes aware
Oct 20, 02:00	Client app updates published
Oct 20, 09:15	cloudflared update published
Oct 20, 19:20	CDN and server-side Zero Trust mitigations fully deployed

Cloudflare says its CDN, Developer and Zero Trust products are now mitigated, and Zero Trust customers using Gateway with an up-to-date client are protected automatically. The post does not name the eight certificates, and it gives no browser distrust dates; it says browser makers moved quickly.

What to do

Cloudflare lists these steps:

• Cloudflare One / WARP and the 1.1.1.1 app: update to version 2026.8.2115.0 on Windows, macOS and Linux; Android 2.5.7 (Cloudflare One) or 6.38.11 (1.1.1.1); iOS 1.12.7 (Cloudflare One) or 6.31.8 (1.1.1.1).
• Cloudflare Tunnel: update cloudflared to 2026.10.2, and redeploy container images.
• Mutual TLS: review the CAs you trust for client certificates.
• Origin servers on Full (strict): check your origin certificates. Cloudflare plans to notify customers still using affected certificates through Automatic SSL/TLS.
• Containers and apps: update trust stores in images and dependencies, and never fix certificate errors by turning off verification.

Who it affects

Anyone running Cloudflare Tunnel or WARP on servers, and developers whose apps, containers or VPS images ship their own certificate trust store. If you run your own servers, our VPS hosting comparison covers the main providers.