On October 19, 2026, at approximately 17:00 UTC, Cloudflare became aware that private keys associated with eight eMudhra intermediate certificates were compromised. These certificates were widely trusted by browsers, operating systems, and also within Cloudflare. Because the keys themselves are weak, an attacker can create a forged certificate for any domain and use it to impersonate servers to intercept or modify traffic.
8 eMudhra certificates are compromised. Here's what you need to know
About this summary. This is a short excerpt from the description that Cloudflare published with its article. Cyber Security News did not report or verify the underlying story. Read the original: https://blog.cloudflare.com/emudhra-certificate-compromise/
Source attribution: headline and facts are from Cloudflare (blog.cloudflare.com). Summary method: excerpt of the source description. See our source attribution policy.
Related coverage
CISA Warns of Node2Shell Exploitation as Honeypots Log Attack Attempts
CISA added the Brotli flaw to its KEV catalog, and two honeypot operators logged attempts, including one that used a broken exploit.
Tailscale warns of SSH flaws allowing root privilege escalation
The Tailscale security team is working to patch almost a dozen security vulnerabilities that could be exploited to steal credentials, crash servers, gain root…
Artificial Intimacy: Love and lies in the age of AI
AI is becoming a third wheel in relationships, increasingly playing a role in the most intimate parts of our lives. It shows up in the flirty first text, the polished…
71% of vulnerability exploitation starts within a week of disclosure
Attackers are exploiting newly disclosed security flaws within days, leaving organizations little time to respond, according to Rapid7’s Q3 2026 Quarterly Threat…
Linux Flaws Exposed Before Fixes as Root Exploit Goes Public
Six Linux flaws were made public, including one with a working root exploit and no merged fix
PHP2Shell Exploitation Moves From Probes to Working Shells
Attackers successfully exploited the PHP2Shell flaws against honeypots, launching 35 shells from two IP addresses on October 24.