Google, Apple and Mozilla have blocked eight digital certificates issued by Indian certificate authority eMudhra after researchers discovered dangerously weak private keys that could allow attackers to impersonate websites.
The security incident came to light on October 17, 2026, with Cloudflare confirming on October 19 at around 17:00 UTC that the compromised keys posed a serious risk to internet security.
The vulnerability would enable hackers to produce fake certificates for any domain and possibly to hijack or manipulate Internet traffic. Major browsers, operating systems and internet infrastructure providers trusted the certificates.
Cloudflare and other tech firms have implemented emergency patches to mitigate the danger, and developers and organisations have been urged to patch vulnerable software or security systems.
Eight intermediate certificates have been issued by in the incident. Security researcher Wayne, who brought the problem to light on October 17, said the certificates had private keys that could be compromised with just three to eight bits of effective key space.
To demonstrate the problem, Wayne created a website at emudhra.we-have-a-problem.com and published a digitally signed message reading, “We have a problem here – Wayne.”
The demo showcased how a malicious party with access to the keys could generate trusted certificates for websites and lull users into entering passwords, credit card numbers and other personal data.
BGP.tools director Ben Cartwright-Cox termed it “bonkers” and suggested that example code could have been accidentally introduced into production systems.
, and Mozilla are planning to block the affected certificates in their Chrome, Safari and Firefox browsers as of October 20. In addition, Cloudflare rolled out mitigations throughout its content delivery network, developer services and Zero Trust products.
Cloudflare was alerted to the stolen keys in its security update around 17:00 UTC on October 19. The company said that, through a security review, it had not identified any active exploitation of the problem on its own services.
Cloudflare published updates for the Cloudflare WARP and 1.1.1.1 apps and for “cloudflared”, the Cloudflare Tunnel. It recommended that individuals update any impacted applications and organisations review their certificate trust stores and server configurations. The Go programming language maintainers also published security updates for Go 1.27.3 and Go 1.26.10, which reject the compromised keys.
Cryptography engineer Filippo Valsorda warned that cleaning up the vulnerability could be more challenging than resolving the 2014 Heartbleed bug. Other software can accept the compromised certificates and continue to trust them in the case of outdated operating systems, embedded devices, smart home products or background services.
Other work was underway to remediate the issue, Cloudflare said, and some systems would require manual updates or redeployment.
Certificate transparency logs have shown no evidence, so far, that the weak keys were used to issue malicious certificates. This doesn’t necessarily mean that all types of misuse are excluded.
It’s typically not possible to exploit certificates and impersonate a site without being positioned between the user and the real site. For everyday users, the immediate precaution is to install the latest available browser, operating system and security application updates.
