The News, Explained
On October 30, 2026, Cloudflare published a follow-up report on weak signing keys associated with eMudhra certificates. It describes evidence of misuse and patching based on the company’s connection logs and visitor test connections. Cloudflare learned about the eight weak keys on October 19; the new report covers subsequent observations. Source
A certificate is an electronic document used to check a server’s identity during an Internet connection. Cloudflare says private keys for eMudhra intermediate certificates, which sign other certificates, were weak enough to recover from public certificates and use to create forged certificates for arbitrary domains. TLS protects Internet communications; the initial response document addresses certificate-based authentication and the lists of trusted certificate authorities. Source Source
A trust store is a list of certificate authorities that software trusts. An app may delegate certificate checks to an HTTP communications library, its runtime, the operating system or a custom configuration. Cloudflare’s initial guidance distinguishes a browser check from the actual verification path of a background service. Updating an SDK, a bundle of developer tools, may leave the underlying certificate-verification policy unchanged. Source
For its visitor study, Cloudflare sent test connections from a fraction of its security challenge pages. The company reports roughly 50 million probes over the preceding week. These connections come from clients that execute JavaScript, and the sample contains substantial traffic from suspected bots. The counted unit is a test connection. Source
The report says 30–40% of embedded browsers such as Android WebView, a browser component inside an app, still accepted the affected certificate chain. That observation applies to the test-connection sample in the report. The sample’s bot-heavy composition and JavaScript requirement belong alongside the percentage when interpreting it. Source
Measurement conditions changed, too. Probes stopped from October 23 at 16:30 UTC until October 27 at 10:00 UTC, and the test servers’ certificates and certificate chains changed. On October 27, sampling increased from 1% to 10% of challenge pages on domains of non-paying customers. An October 29 change in bot classification also affected the movement of browser-specific figures. Given the changing traffic mix, Cloudflare treated some evidence of patching trends as suggestive. Source
Its network logs form a separate observation. Cloudflare says it completed the logging rollout on October 21 and saw about 22,000 attempted TLS handshakes using the weak keys over the following week. A handshake is the connection-setup stage that includes certificate checks. Roughly two-thirds were connections to test sites, and most of the remainder were origins presenting certificates they appeared to have made for themselves using the weak intermediate. The company says it refused every handshake configured to verify certificates after patching. Source
About 160 of those handshakes presented certificates naming other organizations’ domains unrelated to the requested hostname. Cloudflare described indications that they were servers’ default certificates, along with hostname mismatches. It reported no evidence so far of the weak keys being used to intercept its connections, while leaving open carefully targeted interception. At report time, Cloudflare said all its high-priority systems were patched and a small number of confirmed low-impact tasks remained in progress. Source
OYOPICK’s Take
Our criterion for reading this report is the scope of the software whose protection has actually been checked. The initial guidance explains why a browser and an app using another verifier can have separate update needs. If app and operating-system update notices show which trust stores they update, users could judge the scope of the protection they have checked more clearly.
Cloudflare also describes plans to expand the quick-revocation mechanism already used in some of its products. Revocation tells software to stop trusting a problematic certificate. We would like that information to reach an app’s actual verification path promptly, with clearer ways to check that it has been applied. Progress can be assessed through follow-up evidence that identifies the products covered and the scope of deployment and operational verification. Source Source