Microsoft Removes Trust in Remaining eMudhra Root Certificates on November 16, 2026
Microsoft announced it will revoke trust for the last ten eMudhra root certificates starting November 16, 2026, through its automatic Certificate Trust List updates on Windows systems. This update follows a previous emergency revocation of eight compromised eMudhra intermediate certificates and seven root certificates in October 2026. Researchers found that private keys for eight intermediate certificates could be derived due to a flawed generation script, allowing attackers to potentially forge TLS and code-signing certificates under eMudhra's roots. Microsoft Edge and WebView2 Runtime will also distrust these root certificates simultaneously via the PKI Metadata component, ensuring comprehensive coverage. For air-gapped systems, Microsoft plans to offer an offline update package to manually remove the compromised roots, safeguarding isolated networks from forged TLS and code-signing threats.
Linha do tempo
-
Microsoft Removes Trust in Remaining eMudhra Root Certificates on November 16, 2026
ler a análise desta fonte ocultar
Microsoft announced it will revoke trust for the last ten eMudhra root certificates starting November 16, 2026, through its automatic Certificate Trust List updates on Windows systems. This update follows a previous emergency revocation of eight compromised eMudhra intermediate certificates and seven root certificates in October 2026. Researchers found that private keys for eight intermediate certificates could be derived due to a flawed generation script, allowing attackers to potentially forge TLS and code-signing certificates under eMudhra's roots. Microsoft Edge and WebView2 Runtime will also distrust these root certificates simultaneously via the PKI Metadata component, ensuring comprehensive coverage. For air-gapped systems, Microsoft plans to offer an offline update package to manually remove the compromised roots, safeguarding isolated networks from forged TLS and code-signing threats.