eMudhra: keys for eight TLS certificates were compromised
20-21 Oct 2026 (late catch): Cloudflare says the private keys for eight eMudhra intermediate certificates were compromised, and that the keys were weak enough that a forged certificate could impersonate a site.
Browsers have distrusted them. Servers, apps, and bots that carry their own trust store still need an update. Cloudflare reported no active exploitation on its own services. Research snapshot from Cloudflare.
369 take
Update the OS, browser, wallet app, and the CA bundle your bots actually use. If a certificate error appears, fix the trust store. Do not turn certificate checks off.
Sources