Reported by 2 outlets
The story so far
AI summary of the reporting below · Updated · How we work
Microsoft released emergency out-of-band updates on October 26 to strip trust from certificates tied to certificate authority eMudhra. The patch, arriving as KB5134133 for Windows 11 versions 24H2 through 26H2 and KB5134125 for Windows 10 versions 21H2 and 22H2, removes seven higher-level certificates from the Windows trust list. The action targets six eMudhra G3 roots and an AAA Certificate Services cross-sign, with matching removals scheduled for the Microsoft Edge browser trust list on October 27. [1][2]
The intervention follows the discovery that eight intermediate certificate keys generated by eMudhra in April 2025 were dangerously weak. Because those keys had values under 256, attackers could test every possible combination nearly instantly to forge certificates, impersonate legitimate websites, or intercept encrypted traffic. While major tech companies including Apple, Google, and Mozilla moved alongside Microsoft to revoke or block the eight vulnerable intermediate certificates, Microsoft escalated its response by severing trust in the broader parent roots. [1][2]
The standalone patches specifically target offline machines, disconnected networks, and systems where automated Certificate Trust List updates are shut off. Microsoft is advising network administrators to audit and replace any dependent certificates across their environments. The company noted that it continues to investigate eMudhra's remaining roots and may implement further restrictions if necessary. [1]
Microsoft has released out-of-band (OOB) Windows updates to remove trust in certificates tied to compromised eMudhra certificate authority keys, protecting systems that do not receive automatic certificate trust updates.
via BleepingComputer
Yesterday, October 26th, Microsoft released a Windows security update that removes seven certificates associated with Indian company eMudhra. The reason for this is that the private keys for eight intermediate certificates held by eMudhra were recently discovered to be so weak that they could be easily recreated, allowing attackers to forge digital certificates and pose as legitimate websites or applications.
via PCWorld