What happened
Microsoft issued KB5134133 for Windows 11 versions 24H2, 25H2 and 26H2, and KB5134125 for Windows 10 versions 21H2 and 22H2, on October 26, 2026. According to BleepingComputer, the out-of-band updates remove seven certificates from the Windows trust list: six eMudhra G3 roots and an AAA Certificate Services cross-sign. Microsoft said the same seven certificates would also be removed from the Edge trust list on October 27.
The updates are aimed particularly at systems that do not receive automatic certificate trust updates: devices without internet access, systems unable to reach Microsoft's certificate-update service, and installations where automatic Certificate Trust List (CTL) updates are disabled. Microsoft advises administrators to install the update on disconnected Windows systems and identify certificates that depend on the removed roots, since those certificates may need replacement.
The change follows the discovery of eight eMudhra intermediate certificate authority private keys that were generated in April 2025 and were weak enough to recover almost instantly. The supplied report says each had a value below 256, meaning an attacker could test only 256 possible numbers. Those keys could have enabled forged certificates for legitimate websites and interception of encrypted communications. eMudhra revoked the eight compromised intermediates, while Mozilla, Google, Apple and other software vendors began revoking them.
Microsoft had already added the eight affected intermediate authorities to the Windows Disallowed Certificate Trust List, covering six used for TLS and two for code signing. It also released a CRLSet update for Edge and WebView2, blocking affected TLS certificates without requiring a browser update. The new Windows updates go further: they remove trust in associated roots, which Microsoft describes as a separate and broader trust decision than blocking the identified compromised intermediate keys. Organizations with a specific compatibility need may locally trust a certificate, subject to their own security assessment and policies. Microsoft was still investigating the remaining eMudhra roots and said it might make additional trust changes.
What the archive adds
This is a new fact in the eMudhra certificate-compromise story, not a restatement. Our earlier note, eMudhra: Private key compromise of Intermediate Certificates, describes the weak keys and the rapid patching response; the present development is Microsoft's broader removal of seven associated certificates from Windows trust.
Trend signal
This does not materially fit one of the supplied agent-system patterns. It is a certificate-trust response to compromised cryptographic keys, rather than evidence about agent architecture, protocols, or operational economics.
Why now
The update follows Microsoft's earlier blocking of the eight compromised intermediate authorities. The supplied report says the root removal is a separate, broader trust action, while Microsoft continues to assess the remaining eMudhra roots.
Connections to other events
An earlier Telegram post described Mozilla's report that private keys for eight eMudhra intermediate certificates had been compromised and that Chrome blocked affected keys through CRLSet. Microsoft's update addresses a different layer: it removes trust in associated roots for Windows systems that might not receive automatic trust updates.
Why it matters
Certificate trust is distributed across operating systems, browsers and applications, and a block in one layer does not guarantee that every machine or software stack has received it. The updates give administrators a way to apply Microsoft's trust-list change to Windows devices that are offline or prevented from receiving automatic CTL updates.
The broader root removal may also have operational consequences. Teams that depend on certificates chained to those roots need to identify them and determine whether replacement is necessary; Microsoft's notice explicitly says some dependent certificates may need replacing. That makes inventory and compatibility review part of the incident response, not merely patch deployment. The source does not establish that all eMudhra roots are distrusted or that every affected organization will experience breakage.
Limits and uncertainty
The supplied source is BleepingComputer's report, not Microsoft's own update page. It does not provide a list of affected dependent customer certificates, quantify deployment coverage, or say whether the root removal has caused compatibility failures. The report says Microsoft was investigating remaining eMudhra roots, so the trust changes may not be complete. It also distinguishes removal of seven associated certificates from revocation of the eight compromised intermediate authorities; these are related but not identical actions.
Skill to build now
This week, inventory Windows systems that are offline, cannot reach Microsoft's certificate-update service, or have automatic CTL updates disabled. For those devices, check whether the relevant KB update is installed, then identify certificates whose trust chains depend on the removed roots and flag any that need replacement. Keep that dependency review separate from checking whether the eight compromised intermediates are blocked.
Reader takeaway
The update is not simply another block of the eight compromised intermediate certificates: Microsoft is removing seven associated roots and a cross-sign from Windows trust as well. Administrators should prioritize systems that miss automatic trust updates, then check dependent certificates for compatibility and replacement needs.