eMudhra certificate flaw: check your app’s trust store

Cloudflare’s latest account of the eMudhra certificate incident gives commerce teams a reason to check how their apps verify HTTPS connections, even if their browsers are already updated.

In its 30 October follow-up, Cloudflare describes around 22,000 connection attempts involving the weak keys. Most involved test sites or origins apparently issuing certificates for themselves. About 160 handshakes involved certificates naming unrelated organisations.

Those are handshakes, not a count of distinct forged certificates or successful attacks. Cloudflare says it has found no evidence that its connections were intercepted. The suspicious certificates would also have failed hostname checks. It cannot rule out carefully targeted interception elsewhere.

Check the service that makes the connection

Cloudflare’s technical guidance explains why an SDK update or a browser test can be insufficient: an app may rely on a separate HTTP library, runtime, operating system or custom certificate configuration. Apply the relevant fixes, rebuild affected images and check whether a restart or redeployment is required.

For merchants, our recommendation is to ask the team operating each custom integration to identify that verification path. Include background jobs that exchange order, fulfilment or customer information with other services. Record who maintains the certificate trust configuration and how the running application was checked.

If an update starts producing certificate errors, investigate the remote certificate and configuration. Cloudflare explicitly warns against disabling verification to make those errors disappear.

Keep the two security checks separate

This is distinct from the Node2Shell runtime vulnerability. A deployment review can cover both, but completion should identify the fix and validation for each issue. A reassuring browser result does not establish that an order-sync worker uses the same trust settings.

The official post below links Cloudflare’s investigation. Its observations concern its own systems and measurements; they do not establish that a particular merchant’s data was accessed.

Four. Just four. That’s the key to any unpatched connection using eMudhra certificates. Here’s how we patched our network, what exploitation attempts we’ve seen, and how much of the Internet is still exposed. Read more: https://t.co/cFg5p8Lxzk

— Cloudflare (@Cloudflare) October 30, 2026

Read Cloudflare’s original post, 30 October 2026