INTEL: Eight eMudhra Certificates Compromised in Major Internet Security Incident

Eight digital security certificates issued by Indian certificate authority eMudhra have been compromised, potentially allowing attackers to impersonate websites and intercept or modify encrypted internet traffic on vulnerable systems.

Google, Mozilla, Apple and Microsoft have taken steps to block the affected certificates. Cloudflare has also deployed emergency security updates across its infrastructure and client software.

The incident was publicly disclosed on October 20, 2026, after security researchers identified severely weakened private keys associated with eight eMudhra intermediate certificates.

How Could Attackers Impersonate Any Website?

Digital certificates help browsers and applications verify that they are communicating with legitimate websites.

The compromised eMudhra certificates included six used for website security and two associated with code signing.

Researchers discovered that the private keys had been generated with insufficient randomness, making them possible to recover from publicly available certificate information.

An attacker possessing one of the affected certificate authority keys could generate fraudulent certificates for websites they do not control.

If an attacker could intercept a connection and the victim’s software still trusted the compromised certificate authority, the forged certificate could allow the attacker to impersonate the intended website and potentially access or modify communications.

The issue affects website identity verification rather than the underlying encryption algorithms.

Google, Mozilla and Cloudflare Respond

Google confirmed that Chrome blocked the affected website certificate keys on October 17, shortly after receiving the initial security report.

Mozilla implemented similar protections in Firefox that same day. Apple and Microsoft subsequently blocked the compromised certificates on their respective platforms.

Cloudflare confirmed that it became aware of the incident on October 19 and deployed protections across its CDN, Zero Trust and developer infrastructure.

The company also released updates for Cloudflare WARP, its 1.1.1.1 application and Cloudflare Tunnel.

Cloudflare said its security review had not identified active exploitation affecting its services.

Are Internet Users Still at Risk?

The immediate risk to users of major browsers has been substantially reduced.

Google said Certificate Transparency protections would have prevented fraudulent certificates from being accepted by Chrome before the affected keys were blocked.

However, some servers, applications, command-line tools and other systems may continue trusting the compromised certificates until their trust stores or software are updated.

Cloudflare warned that organizations may need to update their own servers, custom certificate configurations and software dependencies.

eMudhra said the incident was limited to the affected intermediate certificates and did not compromise its root certificate authority private keys. The company also stated that the affected intermediates had not issued end-user certificates.

An investigation into the certificate generation failure remains ongoing.