Cloudflare says private keys for eight eMudhra intermediate certificates were compromised, creating a risk that a forged certificate could impersonate a site or intercept traffic if a client still trusts the affected certificates. The company learned of the issue on October 19 and published its response on October 20. This is a certificate-authentication problem, not a break in TLS encryption itself.
Why hosting operators should check their TLS path
Cloudflare says it updated trust stores and deployed mitigations across its CDN, developer and Zero Trust services; its review had not identified active exploitation on Cloudflare services at the time of its report. The wider exposure depends on which certificates an application trusts and how it validates a remote server. A browser update does not necessarily fix an origin proxy, container image, background worker or API client using a separate trust store.
Cloudflare advises customers running Cloudflare Tunnel to upgrade cloudflared to version 2026.10.2 and redeploy fixed container images where applicable. Customers using custom mutual-TLS trust stores should review the CAs they uploaded. Site operators using Full (strict) or Strict origin TLS should check custom origin certificates and server configuration for certificates that may now be distrusted. For applications and containers, update affected dependencies and trust stores, rebuild images, and restart or redeploy services so the changes take effect.
Test the actual verification path used by each workload: a passing browser check is not proof that a server-side client is protected. If certificate errors appear after remediation, investigate the chain rather than disabling certificate verification, which would undo the protection. Cloudflare’s incident guidance and version-specific update list should be the reference for teams using its products.