Cloudflare patches after eMudhra’s weak keys put internet connections at risk

How the flaw works

On 19 October 2026, Cloudflare learned that certificate authority eMudhra had issued eight extremely weak encryption keys. Instead of generating large, random numbers as required for secure cryptography, eMudhra’s system picked simple numbers like 4, 56, and 66. This meant that anyone could easily recover the private keys from public certificates and use them to create fake certificates for any website. Normally, a certificate authority (CA) is trusted to keep these keys secret and strong, so browsers and servers can trust encrypted connections. In this case, the weakness made it possible for anyone to impersonate any website that used eMudhra’s certificates, unless the client enforced strict certificate transparency checks.

The response

Cloudflare started patching its high-impact systems on the same day it learned of the problem. The company focused first on its customer-facing proxies, which handle most outbound connections. These systems were updated within hours to reject any certificates signed with the weak eMudhra keys. Cloudflare also used AI to scan its codebase for other systems that might trust these keys, assigning tickets for each area and prioritising patches based on risk. By the end of the week, all high-priority systems were patched, with only a few low-impact issues still being resolved.

eMudhra has since announced it will exit the public CA business, blaming a script error for the weak keys. However, the company has not shared the faulty script or fully explained how the error went undetected by auditors and cross-signers.

Evidence of exploitation

Cloudflare added extra logging to its systems to detect any use of the weak eMudhra keys. In the week after the flaw became public, Cloudflare saw about 22,000 attempted connections using the vulnerable keys. Most of these were tests or servers using the weak keys for their own domains. However, around 160 attempts involved forged certificates that listed domains unrelated to the requested server. Some of these domains were linked to consumer IoT devices. The first forged certificate appeared less than an hour after the weakness was made public. Cloudflare found no evidence that these certificates were used to intercept its own traffic, but the speed of exploitation shows how quickly attackers can move when cryptographic keys are weak.

Who is affected

Any system or client that trusts eMudhra’s certificates and does not enforce certificate transparency could be at risk. Cloudflare cannot directly test visitors’ systems without breaking connections, but used indirect methods to estimate the number of unpatched clients. Over 50 million probe connections were run, showing that some visitors still accepted the weak certificates days after the flaw was disclosed.

What you should do

Organisations using eMudhra certificates should immediately revoke and replace them, and ensure their systems reject certificates signed with the known weak keys. Clients and browsers should enforce certificate transparency and keep their trust stores updated. Cloudflare’s approach, rapid patching, codebase review, and active monitoring, offers a model for incident response when a trusted CA fails.