Skip to content
Sıfırıncı Dakika
TR
Latest
Malicious Claude Code extension in Cursor's marketplace attempted data theft

Cloudflare logged 22,000 TLS attempts with eMudhra's weak keys

SecurityAnalysis2 min read
Cloudflare Blog

In brief

Cloudflare published a follow-up on eMudhra's weak intermediate certificate keys. Since October 21 the company has seen about 22,000 TLS handshake attempts using the weak keys; two-thirds targeted test sites and most of the rest came from origins that issued certificates to themselves. Cloudflare has patched all high-priority systems.

  • Eight eMudhra intermediate CA keys used trivially guessable values
  • Cloudflare patched high-priority systems within hours
  • AI-assisted code analysis identified all affected systems in four hours
  • About 22,000 weak-key TLS handshake attempts logged in a week
  • All verifying handshakes were refused

What happened

Cloudflare published a second, more detailed analysis of the eMudhra weak-key incident that surfaced on October 19, 2026. Eight of eMudhra's intermediate certificate keys were extraordinarily weak: where the company was supposed to pick a 115-digit number, one value was simply "4". The others were similarly guessable values such as 56, 66, 115, 155, 156, 230 and 237.

According to Cloudflare, this differs from past certificate authority compromises (DigiNotar, TÜRKTRUST, TrustWave): the affected private keys can be recovered almost instantly by anyone from the public certificates themselves. That means an attacker can mint fraudulent certificates that unpatched clients would accept.

What Cloudflare did

The company began patching high-impact systems on October 19. Pingora-based proxies, which handle most outbound connections to customer origins, were updated within hours to reject the vulnerable eMudhra keys. An AI-assisted source code analysis identified all other systems trusting the weak keys within four hours. At the time of writing, all high-priority systems were patched, with a small number of low-impact tickets still being worked on.

Signs of exploitation

Cloudflare added logging to Pingora to record certificates signed by the weak keys. In the week after the logging finished rolling out on October 21, it saw about 22,000 handshake attempts. Two-thirds were fetches of test sites such as emudhra.we-have-a-problem.com. Almost all of the remaining third went to origins that appeared to have issued a certificate for themselves using the weak intermediate. Every verifying handshake was refused.

About 160 attempts stood out: their certificates' Subject Alternative Names listed other organizations.

Open questions

eMudhra said it is exiting the public CA business and blamed a mistake in a key generation script, but has not shared the script. Cloudflare questions why a certificate revocation list (CRL) apparently signed with a correctly generated key was later re-signed with the weak key without raising alarms, and asks what role auditors and cross signers played.

Why it matters

It shows with concrete data how fragile trust in a certificate authority can be, and offers a patching and monitoring lesson for system administrators.

Sources

  1. Cloudflare BlogFirst reported byPrimary source
    4 real? Tracking exploitation and patching of eMudhra’s weak keys
#cybersecurity#certificate authority#TLS#patch#Cloudflare

Related stories