Cloudflare reports 22,000 attempts to exploit eMudhra's weak keys, with no evidence of connection interception

Details

Cloudflare detected approximately 22,000 attempted TLS handshakes using eMudhra's weak keys, with forged certificates appearing within an hour of the vulnerability becoming public.
Analysis of the 22,000 attempts found no evidence of active interception of Cloudflare connections; most attempts were test sites or servers presenting their own default certificates with mismatched Subject Alternative Names.
A probe of 50 million challenge page connections revealed that while modern browsers are largely patched, over half of traffic on large networks still accepts the compromised certificate chain.
Embedded browsers like Android WebView lag significantly, with 30-40% still accepting the weak keys, and bot traffic remains a major source of unpatched clients.
Cloudflare patched high-priority systems, including Pingora proxies, within hours of the October 19 disclosure, using AI-assisted code analysis to identify other vulnerable systems.
The eMudhra incident is distinct from previous CA compromises because the weak private keys (e.g., the number 4) could be recovered instantly from public certificates, allowing anyone to forge certificates for any domain.
Future security improvements include adopting dynamic trust stores like upki to allow for quick revocation and certificate transparency updates rather than relying on static root lists.

Key point