Impact

Although Hoxhunt is affected by this global incident, Hoxhunt's own certificates are issued by other providers, so connections from customers to Hoxhunt were never at risk. Exploiting the leaked keys requires an attacker positioned on the network path, and no misuse has been reported by Cloudflare or the browser vendors. We have no indication of any impact on Hoxhunt. We are actively analyzing the situation and implementing the necessary remediation and mitigation measures.

Mitigation measures

Soon after the disclosure, on 21 October 2026 Hoxhunt assessed all related CVEs against its service inventory and confirmed that some apply to Hoxhunt. Trust in the compromised certificates was removed from Hoxhunt's production services in the 21 and 22 October releases. Verification and the remaining internal tooling are in progress.

Supply chain impact

Hoxhunt assesses its sub-processors through its third-party risk management process, and its vendor monitoring system flags reported security incidents involving these providers. We are reviewing our sub-processors' advisories and will note anything material through this support advisory article. 

Actions required on your side

None.

Updates

26 October 2026: Title and various parts of the article's copy were updated and refined. The initial analysis still stands - we have no indication of any impact on Hoxhunt or its customers.