# eMudhra certificate compromise forces urgent trust store updates across Cloudflare stack

> **Key takeaway:** Eight compromised eMudhra intermediate certificate private keys allow attackers to forge certificates for any domain, prompting Cloudflare to patch its entire product stack and urge customer action.

**Published:** 2026-10-20T22:20:16+00:00 
**Source:** Cloudflare Technical Blog 
**Category:** software-engineering 
**Canonical URL:** https://fosswire.org/news/emudhra-certificate-compromise-forces-urgent-trust-store-upd.html 

## Summary
On October 19, 2026, Cloudflare discovered that private keys for eight eMudhra intermediate certificates were compromised. Because these certificates were widely trusted, an attacker with the weak keys could forge valid certificates for any domain to intercept or modify traffic. Cloudflare has patched its CDN, Zero Trust, WARP, cloudflared, and developer products, but warns that some customers must manually update trust stores on their origin servers and review mutual TLS configurations. No active exploitation has been detected on Cloudflare services.

## What Cloudflare patched and what customers must still do
- **Affected certificates**: Eight eMudhra intermediate certificates with compromised private keys, trusted by browsers, operating systems, and Cloudflare's internal infrastructure
- **Attack vector**: Weak keys allow an attacker to forge certificates for any domain, enabling server impersonation and traffic interception or modification
- **Cloudflare patches released**: Cloudflare One Client v2.5.6 (Android), v1.12.16 (iOS), 2026.8.2115.0 (desktop); 1.1.1.1 app v6.38.10 (Android), v6.31.7 (iOS), 2026.8.2115.0 (desktop); cloudflared 2026.10.2
- **CDN and Zero Trust mitigations**: Fully deployed as of October 20, 19:15 UTC for server-side components
- **Customer actions required**: Update mutual TLS trust stores, review custom origin certificates in Full (strict) or Strict mode, rebuild container images, validate application-level TLS verification paths (not just browser or curl tests)
- **iOS exception**: Cloudflare One Agent for iOS still pending app store review as of publication

## Why it matters
The incident exposes systemic fragility in WebPKI trust: browser vendors can revoke quickly via mechanisms like CRLSets, but servers and applications with bundled or custom trust stores require manual intervention. Cloudflare's advocacy for projects like upki reflects growing industry recognition that static root CA lists are inadequate for rapid response.