Cloudflare says private keys associated with eight eMudhra intermediate certificates were compromised. In its October 20 incident report, the company says it became aware of the problem at about 17:00 UTC on October 19 and began updating services that rely on public certificates to authenticate remote systems.
An attacker able to create a certificate accepted through an affected trust path could impersonate a server and intercept or alter traffic. This is a failure of certificate-based authentication, not a break in TLS encryption itself. Cloudflare says its security review has not identified active exploitation on its services; that statement does not rule out activity elsewhere on the internet.
What Cloudflare has changed
Cloudflare says it updated shared trust stores, base images and services across its CDN, Developer and Zero Trust products. It also released security updates for Cloudflare One clients, the WARP and 1.1.1.1 apps, and Cloudflare Tunnel. Its published timeline places client updates early on October 20, a cloudflared update later that morning, and completion of CDN and server-side Zero Trust mitigations at 19:20 UTC.
Cloudflare lists cloudflared 2026.10.2 as the fixed Tunnel release. Users of Cloudflare One or the 1.1.1.1 app should install the version specified for their operating system in the company's advisory. Container deployments need the updated image to be redeployed. Customers who manage their own mutual TLS trust stores or origin certificate configurations may also have work to do.
Why one update may not be enough
A web browser, command-line tool and application server can verify certificates through different stores. Some applications bundle a CA list; others use the operating system, a language runtime or an HTTP library. Cloudflare warns that updating an SDK alone may leave the verifier underneath unchanged. Teams should trace the actual verification path their services use, update affected dependencies and restart or redeploy processes where needed.
Certificate failures after the update are a signal to examine the affected trust chain. Disabling TLS verification to make an error disappear would remove the authentication protection the remediation is intended to restore. Cloudflare also notes that a successful browser or curl check cannot prove that every background service on the same machine is protected.
The practical priority is to apply the vendor's current fixes, review custom trust settings and validate the specific applications that connect to remote services. Cloudflare's advisory remains the source for product-specific versions and any further incident updates.