The key is the number 4. Not four digits, the number 4 itself. That is how Cloudflare describes the weakest of eMudhra's eight keys: where a 115-digit number should be, there is a 4. The other seven are 56, 66, 115, 155, 156, 230 and 237. Cloudflare learned about them on 19 October, and on 30 October it published what it saw in its own network.
Fact
The facts: according to Cloudflare, on 19 October 2026 it learned about eight weak eMudhra keys. JetBrains also writes that the private keys of eight eMudhra intermediate certificates were compromised. The difference from DigiNotar and TrustWave, Cloudflare says, is that the affected intermediate private keys can be recovered almost instantly from the public certificates themselves. Logging in Pingora finished rolling out on 21 October. At the time of writing Cloudflare reports about 22,000 attempted handshakes with the weak keys, two-thirds of them to test sites, and every handshake configured to verify the certificate was refused. About 160 of them stand out: the names in the certificates point to other domains, the certificates were made after the keys leaked, and some are valid for over two years. There is no evidence of interception of Cloudflare's connections. One of the forged certificates is dated 20 October, 18:19 UTC, less than an hour after Mozilla's bug report was made public. For visitors, Cloudflare ran 50 million probes over a week. At the time of writing, all of Cloudflare's high-priority systems have been patched.
The 160 are the curious part. Cloudflare does not call them an attack: the certificates look like the servers' own default certificates. They name domains other than the ones requested, so hostname verification would have rejected them anyway. Several servers showed the same certificate to connections from many Cloudflare locations, which means it comes from the server itself, not from something along the path.
But the keys appear to have been used to forge certificates within hours of the weakness becoming public. That does not rule out carefully targeted interception, Cloudflare writes. It has not seen indirect signs of compromised systems so far.
Anyone can recover the key from the public certificate.
The second half is more unpleasant. Cloudflare cannot directly test whether a visitor still trusts the weak keys without breaking the connection, so it sends two probes through its challenge pages: initially one with an eMudhra certificate, one ordinary. Out of 50 million probes in a week, up-to-date browsers are mostly patched, while bots and old browsers are not. Embedded ones, like Android WebView, lag behind: 30 to 40 percent still accept the keys. After the first weekend there is little movement. The sample is heavily skewed, full of unconfirmed bots, and only clients that run JavaScript send probes.
How many devices worldwide are unpatched stays unknown, Cloudflare's sample does not show it. Neither do we know what the script is. In Cloudflare's words, eMudhra announced it is exiting the public CA business and blames a mistake in a key generation script, but has not shared it yet.
The Cloudflare post gives no CVE number. The numbers that exist are for individual products, such as the JetBrains IDEs.
If you have a client that is not a fully current browser, a bot, an embedded web view or a program with its own trust list, check it. Cloudflare mentions the test site emudhra.we-have-a-problem.com in the developer guidance of its earlier post.
Official primary sources
Cloudflare - 4 real? Tracking exploitation and patching of eMudhra's weak keys, 30.10.2026JetBrains - Compromised eMudhra Certificates: Update Your JetBrains IDEs, ReSharper, .NET Tools, Toolbox App, and Gateway Now, 30.10.2026The visual is generated code-art, no third-party images.