eMudhra certificates are compromised. Here's what you need to know
Claim-checked. Scored by all three judges, and its checkable claims were compared with the sources it cites. How far stories are checked
Private keys for eight eMudhra intermediate CA certificates, including one reportedly equal to the integer 4, are weak enough that anyone could forge certificates for any domain. Cloudflare says it patched its clients, Tunnel and CDN, and found no exploitation on its services, though these details are Cloudflare's own and unverified. Customers must still update origin and mutual TLS trust stores, container images and dependencies, and not disable verification. Browsers can revoke quickly, but other software needs per-stack updates.
Score
0.81total under rubric v2.0
- Significance0.81
- Reader interest0.88
- Audience breadth0.87
- Practical relevance0.95
- Substantiated0.71
- Technical depth0.78
- New information0.94
- Counts against: Promotional0.08
- Counts against: Overclaim0.19
Each judge’s answer per question (0–1), their mean and spread, and what the question adds to the score (weight × mean).
| Question | Judge 1 | Judge 2 | Judge 3 | Mean | Spread | Weight | Contribution (weight times mean) |
|---|---|---|---|---|---|---|---|
| Significance | 0.80 | 0.80 | 0.82 | 0.81 | 0.02 | +0.25 | +0.201 |
| Reader interest | 0.78 | 0.92 | 0.95 | 0.88 | 0.17 | +0.20 | +0.177 |
| Audience breadth | 0.94 | 0.80 | 0.88 | 0.87 | 0.14 | +0.10 | +0.087 |
| Practical relevance | 0.99 | 0.92 | 0.94 | 0.95 | 0.07 | +0.15 | +0.142 |
| Substantiated | 0.64 | 0.60 | 0.90 | 0.71 | 0.30 | +0.10 | +0.071 |
| Technical depth | 0.81 | 0.75 | 0.78 | 0.78 | 0.06 | +0.10 | +0.078 |
| New information | 0.92 | 0.90 | 0.99 | 0.94 | 0.09 | +0.10 | +0.094 |
| Promotional | 0.06 | 0.15 | 0.03 | 0.08 | 0.12 | −0.15 | −0.012 |
| Overclaim | 0.34 | 0.20 | 0.04 | 0.19 | 0.30 | −0.15 | −0.029 |
| Sum of contributions | +0.810 | ||||||
| Claim-check penalty | 0.000 | ||||||
| Total, as published | 0.810 | ||||||
Spread is the highest minus the lowest judge answer. marks a spread above 0.40: the judges disagree, and the story is marked contested.
Claim check
Claim check: 1 matches source · 5 no source given · 2 couldn’t check. Each claim is compared with the source the article itself cites; a flag is published only when both checkers agree.
No source givenDate
Cloudflare became aware on October 19, 2026 at approximately 17:00 UTC that private keys for eight eMudhra intermediate certificates were compromised.
The article gives no link or citation for it.
The article says “On October 19, 2026, at approximately 17:00 UTC, Cloudflare became aware that private keys associated with eight eMudhra intermediate certificates were compromised”
The source says No source to compare with.
No source givenCausal conclusion
Because the keys are weak, an attacker can create a forged certificate for any domain and impersonate servers to intercept or modify traffic.
The article gives no link or citation for it.
The article says “Because the keys themselves are weak, an attacker can create a forged certificate for any domain and use it to impersonate servers to intercept or modify traffic”
The source says No source to compare with.
No source givenNumber
Cloudflare's security review has not identified active exploitation of this issue on Cloudflare services.
The article gives no link or citation for it.
The article says “Our security review has not identified active exploitation of this issue on Cloudflare services”
The source says No source to compare with.
Couldn’t checkVersion
Cloudflare Tunnel (cloudflared) version 2026.10.2 is the upgrade that addresses the issue.
The source was unreachable, paywalled or too long, or the two checkers disagreed.
The article says “Cloudflare Tunnel (cloudflared) Upgrade to 2026.10.2”
The source says No passage could be compared.
Source cited by the article: github.com/cloudflare/cloudflared/releases
Couldn’t checkVersion
Cloudflare One Client fixed versions are v2.5.7 (Android), v1.12.7 (iOS), and 2026.8.2115.0 on Windows, macOS and Linux.
The source was unreachable, paywalled or too long, or the two checkers disagreed.
The article says “Upgrade to: v2.5.7 (Android), v1.12.7 (iOS), Windows Desktop (2026.8.2115.0”
The source says No passage could be compared.
Source cited by the article: downloads.cloudflareclient.com/v1/download/windows/version/2026.8.2115.0
No source givenDate
Cloudflare's CDN and server-side Zero Trust mitigations were fully deployed on October 20 at 19:20 UTC.
The article gives no link or citation for it.
The article says “October 20 19:20 UTC CDN and server-side Zero Trust mitigations fully deployed”
The source says No source to compare with.
Matches sourceQuote
Mozilla's Dennis Jackson has crowdsourced a list of commonly used packages that have been patched.
The cited source says the same thing.
The article says “Mozilla’s Dennis Jackson has crowdsourced a list of commonly used packages that have been patched”
The source says “Site published by Dennis Jackson . This site is the work of many contributors from the community. The source is on GitHub and PRs are welcome”
Source cited by the article: emudhra.we-have-a-problem.com
No source givenCausal conclusion
Browser maintainers could remediate the issue quickly because most browsers use quick-revocation mechanisms such as Chrome CRLSets.
The article gives no link or citation for it.
The article says “Browser maintainers were able to remediate the issue with a flip of a switch”
The source says No source to compare with.
Also covered by
Elsewhere
Elsewhere: HN 1 pts, not on front page
Recorded for context only, checked 24 Oct 2026, 08:53 UTC. It played no part in the ranking.