Hexa Tiger 
Scale My Publication 
SEO for Public Figures 
Cloudflare has recorded about 22,000 attempted handshakes using eMudhra’s weak keys, including forged certificates created within hours of the weakness becoming public. The company said its patched systems refused every handshake configured to verify those certificates. It has seen no evidence so far that the keys were used to intercept its connections.
Cloudflare said the weak keys made the incident unprecedented: anyone could recover the affected intermediate private keys almost instantly from public certificates. Anyone could recover the keys and create certificates for domains that an unpatched client without Certificate Transparency enforcement would accept.
Cloudflare Tracked eMudhra’s Weak Keys
Cloudflare said it learned on October 19, 2026, that eMudhra had used eight weak keys. The company said eMudhra was trusted to choose a 115-digit number for a virtual combination lock protecting the Internet, but chose 4. The other keys were 56, 66, 115, 155, 156, 230 and 237.
Cloudflare began patching high-impact systems that day. Its customer origin-facing proxies using Pingora, responsible for most outbound connections, were patched within hours to reject the keys. An AI-assisted source-code analysis found other systems that trusted them within four hours. Teams then reviewed the analysis and prioritized repairs.
Cloudflare added Pingora logging to detect when a customer server or attacker presented a certificate signed by a weak key. The rollout finished October 21. About a week later, the company reported about 22,000 attempted handshakes.
Two-thirds were requests to test sites, including emudhra.we-have-a-problem.com. Almost all of the remaining third went to origins that appeared to have created certificates using the weak intermediate. Cloudflare said its patched systems refused every handshake that checked the certificate.
Forged Certificates And Visitor Updates
About 160 handshakes stood out because the certificates named organizations’ domains unrelated to the requested server name. Some names belonged to consumer IoT devices. Cloudflare said some forged certificates were made after the keys leaked, and some were valid for over two years, longer than any public CA may issue.
The certificates looked like servers’ own default certificates, Cloudflare said, rather than evidence of attempts to intercept its connections. They named domains other than those requested and would have failed hostname verification. In several cases, Cloudflare locations received the same certificate from a server, suggesting it came from that server instead of a single network path. The company reported no interception evidence, but said carefully targeted activity could not be excluded.
To estimate whether visitors still trusted the keys, Cloudflare sent two probes from a portion of challenge pages. One went to a host with an eMudhra-signed certificate; the other went to a control host. Cloudflare reported 50 million probes over the last week, but warned that unconfirmed bots skewed the sample and only clients running JavaScript sent probes.
The setup changed several times between October 23 and October 27. Cloudflare reported that modern browsers were mostly patched, while bots and older browsers were not. It said 30 to 40% of Android WebView clients still accepted the weak chain. After the first weekend, it saw little movement, though it called the evidence suggestive rather than conclusive because traffic patterns changed.
Cloudflare’s Advice Is To Patch
Cloudflare told users to patch. It pointed developers, especially those using macOS, to crowdsourced instructions from Dennis Jackson. Customers using WARP or Tunnel were directed to Cloudflare’s earlier guidance. Related coverage has examined other infrastructure fixes, including Cloudflare’s container security fix, its web application firewall detection, and a separate hosting server security update.
Cloudflare said it wants to extend its quick-revocation mechanism to more of its systems and the wider industry. It pointed to projects such as upki, which account for fast updates to trust stores with revocation and Certificate Transparency information. The company’s account of eMudhra key exploitation describes its monitoring and remaining uncertainty. Its immediate advice remains to install applicable security updates.
