Product: Essential Cloud
Status: Patching in progress
Last updated: 21 October 2026, 13:30 BST
Summary
On 20 October 2026, it became publicly known that the private keys for eight eMudhra intermediate certificates are weak and compromised. These certificates were widely trusted by browsers, operating systems and software trust stores. An attacker could use them to forge a certificate for any domain and impersonate servers in order to intercept or modify traffic.
This is an Internet-wide issue and is not specific to Essential Cloud. We have not identified any evidence of exploitation affecting Essential Cloud or our customers.
Our response
We are patching all Essential Cloud software and services. Our work is prioritised as follows:
- Services that authenticate remote endpoints using public certificates, such as outbound API calls, connections to external services and proxies connecting to origins.
- Shared trust stores, base images and other shared foundations, so that services inheriting their trust configuration are fixed together.
- Applications with bundled or custom trust stores, which are assessed and updated individually.
- Reloads, restarts and redeployments required to activate each update.
This work addresses certificate-based authentication. It is not a weakness in the encryption algorithms used by TLS.
Current status
Patching is currently in progress and there maybe be some short periods of disruption as we continue to push updates to each region. We hope to keep this to a minimum and will update this page once we have more to share.
Questions and support
If you have questions or see unexpected certificate errors, contact support@enterprise-architecture.org
References
- Dan Goodin (Arstechnica), The Internet goes on high alert after discovery of 8 compromised TLS certs
- Dennis Jackson (Mozilla), test site and list of patched packages