Mozilla and Cloudflare announced security updates on October 20, 2026, after private keys for eight eMudhra intermediate certificates were compromised, creating a risk of website impersonation across software that trusts them. Mozilla said an attacker able to intercept a connection could use fraudulent HTTPS certificates to read or alter traffic. The updates extend protection beyond earlier browser blocklists.

eMudhra said the incident involved intermediate certificates created during an April 2025 key-generation ceremony. Its investigation remains ongoing. The company said its root CA private keys and other intermediate CAs were unaffected, and that none of the affected intermediates had issued end-entity certificates. Those statements describe its findings, while browser vendors have acted to remove trust.

According to Cloudflare, the compromised keys are weak enough to enable forged certificates for arbitrary domains. The failure concerns certificate-based authentication rather than TLS encryption algorithms. Cloudflare said its security review had found no active exploitation on its services; that finding does not establish whether exploitation occurred elsewhere.

Mozilla received the report on October 17 at 20:06 UTC and completed distribution of its OneCRL blocklist update to normally configured Firefox installations by 22:59 UTC. On October 20 it released Firefox 158.0.1 and ESR versions 115.43.1 and 153.5.1 for users whose settings could have blocked that delivery. NSS 3.131.1 also removes the signing root from its trust list to protect other applications.

Cloudflare said its CDN and server-side Zero Trust mitigations were fully deployed by 19:20 UTC on October 20. Customers using Cloudflare Tunnel should upgrade cloudflared to 2026.10.2 and redeploy affected container images, according to its guidance. It also released Cloudflare One and WARP client updates and advised customers to review custom certificate trust configurations.

Cloudflare urged developers to check the certificate-verification components beneath their SDKs, including runtimes, operating systems and bundled trust stores. Relevant updates may require rebuilding images or restarting services. It cautioned against disabling certificate verification to suppress errors and said a successful browser test cannot establish that a separate application is protected.