Microsoft published out-of-band Windows updates on 26 October that take seven certificates off the trusted root list, after eight eMudhra intermediate CA private keys turned out to be recoverable in seconds.
What happened
A researcher known as Wayne found the weakness on 17 October while scanning public certificate data. According to Mozilla's incident report, all eight certificates carried P-384 private keys generated in April 2025 with values smaller than 256, which means 256 guesses recover the key outright. Fluepke published one of them on GitHub; its value was 4.
eMudhra blamed a script error that produced a second, weaker key set in April 2025, which was then selected for signing because the labels looked similar. Some certificates were also cross-signed by Sectigo. eMudhra revoked all eight, stopped issuing under its G3 root, and says it found no evidence the keys were used to issue end-user certificates or were abused.
Microsoft first added the eight intermediates to its disallowed list and pushed a CRLSet update for Edge. The 26 October step goes further: KB5134133 covers Windows 11 24H2, 25H2 and 26H2, KB5134125 covers Windows 10 21H2 and 22H2, and both remove six eMudhra G3 roots plus an AAA Certificate Services cross-sign from the Windows trust list. Edge follows on 27 October.
Who is affected
- Windows 10 and Windows 11 machines that do not receive automatic certificate trust list updates
- Offline and air-gapped hosts, and any estate where CTL updates were disabled by policy
- Software carrying its own certificate store, including Go builds below 1.27.3 and 1.26.10, which fix the same issue under CVE-2026-111943
- macOS's built-in curl, which Mozilla's Dennis Jackson warns does not check revocation information
What to do now
Install the out-of-band update on every Windows machine that does not get automatic trust updates, then test the internal sites and applications your staff actually use.
- Push KB5134133 or KB5134125 through your patch tool rather than waiting for Windows Update to find it
- List any internal site or line-of-business app whose certificate chains to an eMudhra root, then expect a trust error after the update
- Use the mitigation and test endpoints published by Mozilla to confirm whether a given host still trusts the revoked hierarchy
- Where a legacy app genuinely needs the root, document it as a time-boxed exception with a named owner
What this means for South African businesses
For most SMEs the practical damage here is not interception, it is the branch server, POS terminal or old ERP box that suddenly refuses a certificate and stops a business process. That risk concentrates on equipment configured years ago with trust updates switched off and nobody left who remembers why. My read is that the forged-certificate scenario is theoretical for a small business, while the certificate-breakage scenario is likely enough to justify testing this week rather than next.
Source: BleepingComputer, 27 October 2026; disclosure detail from Mozilla bug 2083449.
Also on the blog
Next step: If this is on your network or a client's, ask Matthews Enterprises to check exposure.