Cloudflare spots 22,000 handshakes using weak eMudhra keys

Security researchers recently discovered a major security flaw involving eMudhra, a digital certificate authority. Instead of using complex cryptographic numbers for virtual locks, the organization used numbers as simple as four, 56, and 66. This mistake meant anyone could easily recover the private signing keys from public certificates and create valid-looking digital credentials.

Tracking Exploitation and Network Activity

Following the disclosure, Cloudflare rushed to patch its own high-impact systems within hours. The company updated its outbound proxies and used automated code analysis to find and fix vulnerable points. To monitor any malicious activity, engineers added logging features to track connection handshakes using the compromised keys.

Over a span of one week, the network recorded roughly 22,000 connection attempts involving the weak eMudhra credentials. A large portion of these attempts were simple tests or automated checks. However, researchers also spotted forged certificates naming unrelated domains shortly after the vulnerability became public.

Measuring Visitor Vulnerability

To check if internet visitors still trusted the flawed certificates, the platform deployed probe connections on user challenge pages. Running fifty million probes helped gather indirect data on which clients still accepted the weak security keys. While the analysis showed that many systems have updated, some traffic continues to reveal lingering vulnerabilities across the web.