On October 19, 2026, at approximately 17:00 UTC, infrastructure and security teams at Cloudflare became aware of a major cryptographic security incident affecting the wider web ecosystem. Private keys associated with eight eMudhra intermediate certificates had been compromised. These specific certificates held widespread trust across major web browsers, various operating systems, and within Cloudflare’s own internal architectures. Because the underlying keys themselves are considered weak, this breach allows any malicious actor who possesses them to forge a valid certificate for virtually any domain on the internet. With such a forged certificate, an attacker could successfully impersonate legitimate servers, intercept encrypted traffic, or quietly modify data in transit, presenting severe implications for global internet security and digital trust.
Cloudflare immediately shifted its operational priorities to patch and secure critical services across its global network, racing to protect customers well ahead of the broader public disclosure of the vulnerability. Internal security reviews conducted following the discovery have not identified any active exploitation of this cryptographic weakness across Cloudflare services. The company acted swiftly to release targeted updates for the Cloudflare One Clients—commonly known as WARP or the 1.1.1.1 application—alongside critical security patches for Cloudflare Tunnel, also referred to as cloudflared. Concurrently, engineers deployed essential mitigations across Cloudflare’s massive content delivery network, developer tooling, and Zero Trust product suites. Organizations utilizing Cloudflare Zero Trust configured with Gateway and running up-to-date client software find themselves automatically shielded from potential interception attempts.
Our Response
In the hours following the discovery, Cloudflare’s engineering teams prioritized updating services that rely on public certificates to authenticate remote endpoints. This critical effort included securing proxies connecting to origin servers and applications executing calls to external application programming interfaces. In parallel, teams updated shared trust stores, base images, and other foundational infrastructure components, establishing a reliable mitigation path for various downstream services that inherit their certificate trust from those shared sources.
These necessary updates were paired with the technical reloads, restarts, and container image deployments required to activate them effectively across the network. Applications equipped with custom or bundled trust stores underwent separate, rigorous assessments and targeted updates. Industry experts note that this extensive remediation work directly addresses certificate-based authentication and trust validation, rather than pointing to any inherent weakness within the underlying encryption algorithms of Transport Layer Security itself.
Teams across Cloudflare are presently working around the clock on further remediation tasks. While significant progress has been made in hardening the network perimeter and internal services, substantial work remains. A crucial realization of this incident is that some customers will need to take independent action regarding software or trust configurations that they operate directly, with a particular emphasis on their origin servers.
What Customers Should Do
For users operating specific software or services affected by the compromised eMudhra certificates, timely action is vital. Users running Cloudflare One or WARP clients are strongly advised to upgrade their software immediately. Android users should update to version 2.5.7, iOS users to version 1.12.7, while users on Windows Desktop, macOS, and Linux must update to version 2026.8.2115.0. Similarly, users of the 1.1.1.1 application need to upgrade to version 6.38.11 on Android, version 6.31.8 on iOS, and version 2026.8.2115.0 across Windows Desktop, macOS, and Linux environments.
Administrators utilizing Cloudflare Tunnel must upgrade their instances to version 2026.10.2, and those managing containerized deployments are required to update and redeploy the fixed container images. Organizations relying on customer-configured TLS client authentication must thoroughly review and update their mutual TLS trust stores and any uploaded certificate authorities previously used to verify client certificates.
Furthermore, customers operating custom origin TLS servers need to review their custom origin certificates and server configurations if they currently utilize Full strict encryption mode or strict mode. Cloudflare is actively updating its Automatic SSL and TLS features to automatically notify customers if they are still using these distrusted certificates, which would otherwise lead to application breakages and connectivity failures.
Customers utilizing Cloudflare Containers, including isolated sandboxes, must review their container images and application dependencies to identify affected certificate trust stores and apply necessary updates according to their specific deployed images. Alternatively, customers can enable HTTPS egress interception to route outbound HTTPS requests securely through Cloudflare. This shifts remote-server certificate validation away from the application and onto Cloudflare-managed infrastructure, allowing the company’s trust-store mitigations to protect intercepted connections automatically. Containers configured with this feature enabled are already fully protected.
Developer Guidance
Software developers must look beneath the standard software development kits when auditing their applications. An API client frequently delegates certificate verification processes to an underlying HTTP library, a language runtime, the operating system itself, or a custom trust configuration, meaning that merely updating an SDK may not alter the underlying verification policy.
Once patches are applied, developers may notice unexpected certificate errors appearing within their management dashboards. It is critically important that administrators do not resolve these validation errors by simply disabling certificate verification, as doing so would entirely remove the security and authentication protections these updates are designed to restore.
Because this severe incident affects numerous software stacks that rely on the broader WebPKI for authentication, community collaboration has proven essential. Mozilla security researcher Dennis Jackson has crowdsourced a comprehensive list of commonly used packages that have already received patches. Analysts advise readers to upgrade their software environments as quickly as possible. Because some vulnerable packages may exist as indirect dependencies within a software stack, developers must examine their complete dependency tree, apply relevant dependency updates, rebuild affected container images, and confirm whether applications require a formal reload, restart, or full redeployment.
Dennis Jackson’s public test site provides valuable resources, including browser checks, non-browser testing instructions, and specific package update information. However, security professionals warn that test results apply only to the specific verification path being actively tested, rather than every application installed on a given device. Organizations must validate security posture through the actual TLS path utilized by their applications. A successful browser test does not inherently prove that a background service is protected, nor does a successful command-line test if the target application relies on a completely different verifier.
Timeline
The unfolding of the security incident followed a rapid operational response by Cloudflare’s security teams. On October 19 at approximately 17:00 UTC, Cloudflare became aware of the private key compromise and immediately initiated a comprehensive security assessment. By October 20 at 02:00 UTC, security updates for the Cloudflare One Client and the WARP application were published across all supported platforms. Just hours later, at 09:15 UTC on October 20, the security update for Cloudflare Tunnel was successfully released to the public. By 19:20 UTC on October 20, both the core CDN mitigations and server-side Zero Trust protections had been fully deployed across Cloudflare’s global network.
Looking Forward
The overall impact of this cryptographic incident is not felt equally across the technology landscape. Traditional browser maintainers were able to remediate the issue rapidly with minimal friction, largely because they maintain a single application rather than hundreds of disparate services. More importantly, mainstream web browsers benefit from advanced quick-revocation mechanisms, such as Chrome’s CRLSets, which allow for near-instantaneous trust adjustments.
Cloudflare utilizes similar revocation mechanisms for several of its own products, but industry experts emphasize the need for broader adoption of these capabilities. To bring rapid revocation and modern trust management to more systems at Cloudflare and throughout the wider internet industry, engineers are expressing growing interest in innovative projects such as upki. These initiatives operate on the core understanding that a modern trust store can no longer function as a static, unchanging list of root certificate authorities, but must instead possess the dynamic ability to be updated rapidly with critical security information, including real-time revocation data and certificate transparency keys.
