Cloudflare discloses compromised eMudhra intermediate certificates, urges patching
Cloudflare Blog · rss · 2026-10-21
- Incident: On Oct 19, 2026 (17:00 UTC), Cloudflare learned that private keys of eight widely trusted eMudhra intermediate certificates were compromised. The keys are weak, letting attackers forge certificates for any domain and impersonate servers to intercept or modify traffic.
- Response: No active exploitation found on Cloudflare. Security updates shipped for WARP/1.1.1.1 clients and cloudflared; mitigations deployed across CDN, Developer, and Zero Trust products (server-side complete by Oct 20, 19:20 UTC).
- Developer guidance: Updating SDKs alone may not help—certificate verification may live in HTTP libraries, runtimes, or custom trust stores. Check dependency trees, rebuild images, and reload/redeploy as needed; never disable verification to silence errors.
- Validation: Dennis Jackson's crowdsourced list and test site help, but a passing browser check doesn't prove background services on different TLS paths are protected.
- Outlook: Browsers fixed it with a switch via CRLSets-style quick revocation; projects like upki aim to make trust stores dynamically updatable.
More from Infra
- humans& Details Off-Policy RL for Long-Horizon Rollouts, Trained on Its Own Multi-Thousand-GPU Cluster — gharik · 2026-10-21
- PyTorch once anchored NVIDIA's CUDA moat — the moat keeps changing — ivan_bezdomny · 2026-10-21
- Dev powers a Neural-MMO's AI brains with 12 AMD BC-250 mining cards, 3 nodes live — redfoxkiller · 2026-10-21
- ai& claims to be Japan's biggest dedicated inference platform with 100MW+ data centers — DavidBennett__ · 2026-10-21
- SpaceX Reportedly Adding 10GW of Compute by 2027, Up from 1.7GW Today — beffjezos · 2026-10-21
- Musk's Hunt for Rentable GPU Compute Turns Into a Real-Life Cheese Shop Sketch — XFreeze · 2026-10-21