Microsoft has released emergency Windows updates to address security vulnerabilities related to compromised eMudhra certificate authority keys. The updates, distributed on October 26, remove trust in seven certificates associated with affected eMudhra certificate hierarchies from Windows systems. These out-of-band updates target computers that lack automatic certificate trust updates, including disconnected systems and devices unable to access Microsoft’s certificate-update service.
The action follows the discovery that eight eMudhra intermediate certificate authority private keys were extremely weak and could be recovered almost instantly. These keys, generated in April 2025, were so poorly designed that attackers could access them by testing just 256 possible values. The compromised keys posed significant risk by potentially allowing attackers to forge certificates for legitimate websites and intercept encrypted communications. Microsoft has also instructed administrators to identify any certificates dependent on the removed roots, as they may require replacement.
Source: Read the full story at BleepingComputer
This summary was written with AI assistance from the linked source.
Send this to yourself, or to someone who should see it
Enter your email and we will send you a link to this article.
