Vulnerabilities · 14h ago
Cloudflare says it has evidence of attempted exploitation involving eMudhra certificates built on eight weak signing keys, and that all of its high-priority systems are now patched. The company began patching high-impact systems on October 19 and says a small number of low-impact tickets remain.
The keys could be recovered from public certificates because their values were trivially small; whoever obtains them can create a certificate for any website. An unpatched client that does not enforce Certificate Transparency may accept that fake certificate as genuine, particularly while its trust or revocation state remains stale. Replacing or revoking certificates therefore does not immediately cut off every client.
If your browsers, proxies, or services trust eMudhra-issued chains, Cloudflare’s patch protects only Cloudflare’s systems. Exposure can persist on clients elsewhere until they receive and enforce the relevant trust changes.
1 source covering this story
4 real? Tracking exploitation and patching of eMudhra’s weak keys
Four, just four: that’s the key to break into any unpatched connection on the Internet that is using eMudhra certificates.
Part of the PlainSec briefing for 2026-10-31