Cloudflare separates forged certificates from observed interception

Cloudflare reports roughly 22,000 TLS handshake attempts involving eMudhra’s weak keys, mostly from test sites and origins apparently using their own forged certificates. It found certificates naming unrelated domains but no evidence that these intercepted Cloudflare connections; targeted interception cannot be ruled out. Its separate client probes show patching gaps, but bot-heavy traffic and measurement changes prevent interpreting them as an Internet-wide vulnerability rate.

Cloudflare · Oct 30, 2026

Why it matters

Incident telemetry needs careful interpretation: a forged certificate, a failed handshake and a successful interception establish different things.

More context

This October 30 follow-up adds measurements beyond earlier incident coverage. Cloudflare logged outbound certificate use and ran fifty million challenge-page probes, noting rollout gaps and classification changes. Review trust stores used by actual clients and automation rather than extrapolating from browser protection.

Keep in mind

Only JavaScript-executing clients on selected challenge pages sent probes. Cloudflare’s lack of observed interception does not establish that no one elsewhere was attacked, and the probe population is not representative.

Original read