A security email from Cloudflare, and checking it wasn't phishing first

Goal

Work out if the warning was real and if it affected me, then fix it without breaking the site

Result

Updated in minutes, site down for seconds

Tools

cloudflared, apt, Cloudflare Tunnel

The email

At 1am an email arrived from Cloudflare: every cloudflared older than version 2026.10.2 needed updating "as soon as possible". cloudflared is the program on my Pi that opens the tunnel my website goes through, so it matters a lot.

Step one: is it even real?

"Urgent security update" is exactly what a phishing email looks like, so before running anything Claude checked the story independently. Cloudflare had a post about it on its own blog, and news sites were covering it, so the warning was genuine. Then I checked my version on the Pi itself rather than trusting the email.

$ cloudflared --version
cloudflared version 2026.10.1 # one version too old

What the problem was

Websites prove who they are with certificates, signed by companies called certificate authorities. Eight certificates from one of them, eMudhra, were made with private keys so weak they could be worked out (reportedly one was just the number 4). Anyone with those keys could make a certificate for any website, including Cloudflare's, and older cloudflared would trust it. The update stops trusting those eight.

Did it affect me?

• The tunnel itself: yes. My Pi was running a version that still trusted the bad certificates.
• The warning about HTTPS origins: no. That's for setups where cloudflared connects to a website using one of those certificates. Mine connects to Caddy over plain HTTP on the Pi itself, so there was nothing to replace first.
• Active attacks: Cloudflare said it had seen none. Low risk, but an easy fix, so no reason to wait.

The fix

I installed cloudflared from Cloudflare's own package source, so updating it is the same as any other package:

$ sudo apt install --only-upgrade cloudflared
Unpacking cloudflared (2026.10.5) over (2026.10.1) ...
$ sudo systemctl restart cloudflared
$ cloudflared --version
cloudflared version 2026.10.5
$ curl -s -o /dev/null -w "%{http_code}" https://haydnhomelab.com
200

The email suggested adding a second copy of the tunnel first, so the site never goes offline. That's for businesses that can't drop at all. With one tunnel my site was down for the few seconds the restart took, which is fine for a portfolio.

What I learned

• Check a security email is real before acting on it, and go to the source yourself instead of clicking its links.
• Check your own system instead of assuming. "Please update" doesn't tell you if you're actually affected.
• Installing software through a package manager pays off. The fix was one command, not a manual download.
• The whole internet's trust in HTTPS depends on companies keeping their keys safe. When one gets it wrong, every program that trusts them has to be updated.

How I used AI: Claude checked the warning against Cloudflare's blog and news coverage and gave me the commands. I checked my version, ran the update on the Pi and confirmed the site was back up. The full, unedited notes are in my build log.