Microsoft released emergency Windows updates on October 26 to block certificates tied to eight weak eMudhra keys that could be used to fake website identities.
Microsoft has pushed out emergency Windows updates that tell computers to stop trusting certain digital IDs from an Indian company called eMudhra. The reason is simple. Eight of the company's secret keys were so weak that anyone could work them out by trying just 256 numbers. The updates came out on October 26.
A certificate is a digital ID that proves a website is the real one. Your computer checks it before it trusts a site. The weak keys were created in April 2025. With them, attackers could have forged IDs for real websites and spied on private, encrypted traffic.
After the problem came to light, eMudhra cancelled the eight affected certificates. Mozilla, Google, Apple and other software makers began cancelling them too. Microsoft had already blocked the eight, six used for websites and two used for signing software. It also sent a protection update to its Edge browser and WebView2, a tool other apps use to show web pages.
The new updates go a step further. Microsoft removed seven certificates from Windows' list of trusted ones. These are six eMudhra root certificates and one cross-sign tied to AAA Certificate Services. Roots are the top-level IDs that vouch for other certificates. Edge follows on October 27.
Most home PCs can relax. They get these trust changes automatically. The manual updates are for computers that are offline, cannot reach Microsoft's certificate-update service, or have automatic certificate updates turned off. That describes many locked-down business machines.
The updates are KB5134133 for Windows 11 (24H2, 25H2 and 26H2) and KB5134125 for Windows 10 (21H2 and 22H2).
The alert box above lists the steps. In short, update the disconnected machines by hand and check whether anything you run depends on eMudhra certificates. Those may need replacing.
Microsoft says removing a root is a broader decision than blocking the known bad keys. Some organizations may have a real need to trust a certificate locally, but that should follow their own security review. Microsoft is also looking into the remaining eMudhra roots and may make more changes.
Home PCs update on their own, but offline or locked-down Windows machines need KB5134133 or KB5134125 installed by hand.
A user says Anthropic's Claude Code put his email in web requests, then scam messages arrived. The link is unproven, but it shows what AI tools can share.
Read more: User says Claude Code sent his email address to websitesA viral ChatGPT prompt turns what the chatbot remembers about you into a room image. Posting it publicly could give scammers clues to target you.
Read more: Viral ChatGPT room image could hand scammers clues about youA message saying your Amazon account was hacked is often the scam itself. Checking in the Amazon app first can protect your card, gift balance and phone.
Read more: If Amazon says your account was hacked, check before you call
