Product: Essential Cloud
Status: Patching in progress
Last updated: 23 October 2026, 10:15 BST
Summary
On 20 October 2026, it became publicly known that the private keys for eight eMudhra intermediate certificates are weak and compromised. These certificates were widely trusted by browsers, operating systems and software trust stores. An attacker could use them to forge a certificate for any domain and impersonate servers in order to intercept or modify traffic.
This is an Internet-wide issue and is not specific to Essential Cloud. We have not identified any evidence of exploitation affecting Essential Cloud or our customers.
Our response
We are patching all Essential Cloud software and services. Our work is prioritised as follows:
- Services that authenticate remote endpoints using public certificates, such as outbound API calls, connections to external services and proxies connecting to origins.
- Shared trust stores, base images and other shared foundations, so that services inheriting their trust configuration are fixed together.
- Applications with bundled or custom trust stores, which are assessed and updated individually.
- Reloads, restarts and redeployments required to activate each update.
This work addresses certificate-based authentication. It is not a weakness in the encryption algorithms used by TLS.
Current status
Patching is now completed. All Essential Cloud services, applications and related EAS websites have been patched. There was minimal customer impact during this time and all services are now functioning normally.
Questions and support
If you have questions or see unexpected certificate errors, contact support@enterprise-architecture.org
References
- Dan Goodin (Arstechnica), The Internet goes on high alert after discovery of 8 compromised TLS certs
- Dennis Jackson (Mozilla), test site and list of patched packages