Cloudflare's October 30 follow-up says it identified eight eMudhra intermediate certificate keys with extremely low-entropy values, then began rejecting the affected keys in high-priority systems. The incident matters because trusted certificate authorities help browsers decide which server identities to accept.
What the follow-up reports
- Cloudflare says the weakness could allow forged certificates to be created from public certificate data.
- It reports roughly 22,000 attempted handshakes involving the weak keys in its telemetry, while noting that the traffic sample is skewed and is not proof of successful interception.
- The company advises affected users and operators to install current platform updates and follow the vendor guidance for their devices and services.
The post distinguishes observed attempts from confirmed interception and describes several limitations in its measurements. That distinction is important: incident telemetry can show risk and activity without establishing what happened on every connection.
For site operators, the practical response is to keep operating systems, browsers, and TLS trust stores current, and to rely on official incident guidance rather than disabling certificate validation.