Cloudflare patched eMudhra weak keys in hours but much of the Internet is still exposed

After certificate authority eMudhra was found on October 19 to have eight trivially weak intermediate keys, anyone could forge certificates for any domain that unpatched clients not enforcing Certificate Transparency would accept. Cloudflare patched its high-impact systems within hours and has logged roughly 22,000 attempted handshakes with the weak keys since October 21, including forged certificates created within hours of the disclosure. It has seen no evidence so far that its own connections were intercepted. Modern browsers are mostly patched, but Android WebView lags with 30-40% still accepting, and more than half of probes on large networks still trust the compromised chain. Patching remains essential.