On October 19, 2026, Cloudflare learned that private keys for eight eMudhra intermediate certificates were compromised, according to Cloudflare's write-up . Anyone who holds those keys can forge a certificate for any domain and use it to impersonate a server. Browsers shut this down quickly. According to InfoQ , most other software that relies on the web's certificate system has no way to block a single bad intermediate. That software stays exposed until its list of trusted certificates is updated and redeployed. Your servers, containers and API clients are in that second group.

The background you need

When your app opens an HTTPS connection, the server sends a certificate . A certificate is a signed statement that a public key belongs to a domain name. Your app checks the signature to decide whether it is really talking to that domain.…