← Wednesday, October 21, 2026SecurityVulnerability
Compromised eMudhra certificate keys could forge certificates for any domain
Eight compromised intermediate-certificate keys were weak enough to enable forged certificates for any domain; Cloudflare says it updated clients and deployed mitigations across several products. The incident highlights the reach of compromised certificate trust and the response work it triggers.
- What
- Cloudflare said private keys associated with eight eMudhra intermediate certificates were compromised.
- How
- Because the keys are weak and the certificates widely trusted, attackers can forge certificates for any domain to impersonate servers.
- Why it matters
- Cloudflare updated shared trust stores and services; customers may need to update clients, tunnels, and custom trust configurations.
Discussion
Discussion is not switched on yet. Use Note above to keep your own thoughts on this story.
Headline, summary, brief and diagram are written by a model from the source's own text; the link, byline and numbers come from the source. Read the original before relying on a claim.
