How we got here. eMudhra is an Indian certificate authority, one of the companies browsers and operating systems trust to vouch that a website or a piece of software is genuine. Eight of its intermediate signing keys (six for TLS website certificates, two for code signing) were generated in April 2025 with values smaller than 256, per BleepingComputer, so anyone could recover them by trying 256 numbers. With one of those keys, an attacker could mint a certificate that looks legitimate and impersonate a website or sign malware. eMudhra revoked the eight intermediates, and Mozilla, Google and Apple moved to block them.
What's new. Microsoft blocked the eight intermediates on Oct 20 through its Disallowed Certificate Trust List and an Edge/WebView2 CRLSet update. This week it's making a broader call: dropping the roots above them. Microsoft says plainly that "removing a root from a trust list is not the same as revoking" the bad intermediates, and that it is still evaluating eMudhra's other roots. The Windows updates cover Windows 11 (KB5134133 for 24H2/25H2/26H2, KB5134134 for 26H1, KB5134130 for 23H2), Windows 10 22H2 (KB5134125) and Windows Server 2016 through 2025. Microsoft says this was not a compromise of its own systems.
What I'd do today. Most connected Windows machines get the change automatically. The work is in two places. First, offline or locked-down devices, including disconnected Azure VMs, which Microsoft says need the update pushed or a refreshed Marketplace image. Second, your own certificates: search your certificate inventory for anything issued under eMudhra G3 roots (TLS on internal apps, partner APIs, signed software from Indian vendors) and get replacements before the trust change reaches your fleet. If you can't list which CAs your certificates come from in an afternoon, that's the real finding.