Summary and commentary: Geek Haus. Editorial responsibility: Jay Jang, CEO
Back to feedCloudflare says eight eMudhra intermediate certificate keys were compromised, enabling forged certificates for any domain
EDITOR BRIEF
Cloudflare says it learned on October 19, 2026, that private keys for eight eMudhra intermediate certificates were compromised, potentially letting attackers forge certificates for any domain and impersonate servers. It says it has found no active exploitation on Cloudflare services, released Cloudflare One/WARP and cloudflared updates, and deployed CDN, Developer, and Zero Trust mitigations; the Cloudflare One Agent iOS update was still pending app review as of the timeline.
INSIGHTS
Builders should audit the actual TLS verification path for each app, not just update SDKs, because verification may depend on an HTTP library, runtime, OS trust store, or custom bundle. The trade-off is that proper updates, rebuilds, reloads, or restarts may trigger certificate errors, but disabling verification would remove the protection being restored; Cloudflare also notes remediation is ongoing and tests only validate the path being tested.
COMMENTS
Discussion
Next read recommendations
Cloudflare and VoidZero announce tsrs, an experimental Rust port of TypeScript for faster, lower-memory checking
AI code reviewer cuts inference costs 68%, from $2.43 to $0.77 per review, after prompt-cache, call-count, and model changes
