Search — “emudhra”

Microsoft released out-of-band Windows updates KB5134133 (Windows 11 24H2/25H2/26H2) and KB5134125 (Windows 10 21H2/22H2) on October 26 to remove trust in eMudhra root certificates tied to eight intermediate CA private keys that were weak enough to be recovered almost instantly. The sources say the compromised keys could have allowed forging certificates for legitimate websites, but do not report any observed exploitation. Admins are advised to install the updates on disconnected systems and identify certificates that depend on the removed roots, since they may need replacement.

This is a weekly roundup of miscellaneous security news. The brief item highlights Andromeda's October 13, 2026 credential-theft incident, joint NSA/CISA/NIST guidance on containing rogue AI agents, and eMudhra exiting its SSL/TLS business after a CA key compromise. The fetched source gives Andromeda and NIST/CISA details but the eMudhra item is not printed in the visible text, and no adversary technique or huntable artifact is described for these stories.

Cisco Talos reports eight eMudhra intermediate CA certificates were issued with private keys generated from only single- or double-digit entropy, letting anyone holding those keys impersonate sites or sign code. Browsers, OSes, and Microsoft have blocked the certificates, and eMudhra revoked them, but software with independent trust stores or no revocation checking, such as VPN clients, proxies, CI/CD tooling, and embedded devices, may still trust them. Go assigned CVE-2026-111943 and fixed it in 1.27.3 and 1.26.10; Talos reports no malicious use observed as of October 21, 2026, so hunting should focus on exposure review rather than confirmed attack activity.

Certificate authority eMudhra revoked eight intermediate CA certificates whose P-384 private keys were generated with values below 256, letting anyone recover them trivially and forge trusted certificates. Mozilla, Google and Apple blocked the certificates, and Go 1.27.3 and 1.26.10 address the issue tracked as CVE-2026-111943. Software with its own certificate store or that does not check revocation may keep trusting the intermediates until updated, and the sources report no evidence of abuse.