Cloudflare announced tracking 22,000 attempted handshakes using eMudhra's weak keys, indicating the extent of the security issue. This follows an earlier announcement about mitigating the leak and advising customers on necessary actions.
What happened
On October 19, 2026, Cloudflare learned of eMudhra’s eight shockingly weak keys, which could be easily recovered by anyone from the public certificates. Cloudflare took immediate action to mitigate the leak and advised customers on necessary steps. A week later, Cloudflare reported tracking 22,000 attempted handshakes using these weak keys, with two-thirds of the attempts on test sites and the rest on origins setting up certificates with the weak intermediate. All handshakes were refused as Cloudflare had already patched the issue.
What to weigh
- Cloudflare added logging to Pingora to track attempted handshakes with weak eMudhra keys.
- Cloudflare refused all handshakes configured to verify the weak certificate.
FAQ
How many attempted handshakes did Cloudflare track?
Cloudflare tracked about 22,000 attempted handshakes using eMudhra’s weak keys.
What percentage of attempts were on test sites?
Two-thirds of the attempts were on test sites such as emudhra.we-have-a-problem.com.
What percentage of attempts were on origins setting up certificates?
Almost all of the remaining third went to origins who appeared to set up a certificate for themselves using the weak intermediate.
Source: Cloudflare