GoKawiilMicrosoft issues out-of-band Windows updates over weak eMudhra CA keys
Microsoft released KB5134133 for Windows 11 and KB5134125 for Windows 10 on October 26 to remove trust in certificates linked to eight compromised eMudhra intermediate certificate authority keys. The updates target systems without internet access or automatic certificate trust list updates, removing seven certificates including six eMudhra G3 roots and an AAA Certificate Services cross-sign from the Windows trust store.
GoKawiil's interpretation of the reporting above, not reported fact.
The eight keys, generated in April 2025, were so weak they could be recovered almost instantly, meaning attackers could have forged certificates to impersonate legitimate websites and intercept encrypted traffic. Microsoft's manual out-of-band fix suggests that automatic certificate-trust mechanisms alone could not be relied upon to protect offline or restricted systems, prompting coordinated revocation efforts across Mozilla, Google, and Apple as well.
- Microsoft released KB5134133 and KB5134125 on October 26 to distrust eMudhra-linked certificates.
- Eight eMudhra intermediate CA keys generated in April 2025 were weak enough to be recovered by testing only 256 values.
- The update removes seven certificates, including six eMudhra G3 roots and an AAA Certificate Services cross-sign, from Windows' trust list.
Source: bleepingcomputer.com, 2026-10-27
Published there as: “Microsoft releases Windows OOB updates to distrust eMudhra certificates”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.