Microsoft released a set of out-of-band Windows updates on October 26 that change which certificate authorities Windows trusts. The updates remove seven certificates tied to the Indian certificate authority eMudhra from the Windows trusted root list, after it emerged that eight of eMudhra's intermediate signing keys were weak enough to be recovered almost instantly. Microsoft's support page for the Windows 11 package, KB5134133, describes it as a cumulative, non-security update aimed at a specific group of machines, and that targeting is the most useful thing to understand about it.
What went wrong
A certificate authority vouches for websites and software. When your browser shows a padlock, it is because a chain of certificates leads back to a root that your operating system trusts. BleepingComputer reports that eight eMudhra intermediate certificate authority keys, all generated in April 2025, had private values smaller than 256, which means anyone could recover them by trying at most 256 possibilities. With such a key, an attacker could have issued convincing certificates for real websites and intercepted encrypted traffic.
The first response was to stop trusting those specific intermediates. eMudhra revoked them, browser makers including Mozilla, Google and Apple blocked them, and Microsoft added all eight to the Windows disallowed list, six used for website security and two for code signing, plus a separate update to Edge and WebView2 that blocks the affected website certificates without needing a browser update.
The October 26 updates go further. They remove seven root and cross-signed certificates, six eMudhra G3 roots and an AAA Certificate Services cross-sign, from the list Windows trusts at all. Microsoft is careful to say this is a different kind of decision: "removing a root from a trust list is not the same as revoking the known impacted intermediate certificate authorities", and it describes the step as "a separate trust decision, broader than blocking the identified compromised intermediate keys." Microsoft adds that it is still investigating eMudhra's remaining roots and may make further changes. Edge's own trust list drops the same seven certificates on October 27.
Who actually needs to install it
Most Windows PCs do not need to do anything. Windows normally receives trust-list changes automatically through Microsoft's certificate-update service, separately from monthly updates. According to the KB5134133 page and BleepingComputer, these out-of-band packages exist for three cases: machines in disconnected environments, machines that cannot reach the certificate-update service, and machines where automatic trust-list updates have been switched off by policy. That is mostly a concern for businesses, industrial systems and locked-down networks, not a typical home gaming PC.
The packages are KB5134133 for Windows 11 versions 24H2, 25H2 and 26H2 (builds 26100.9725, 26200.9725 and 26300.9725), KB5134130 for Windows 11 23H2, KB5134125 for Windows 10 21H2 and 22H2, and further packages for older Windows 10 and Server releases. They are available through Windows Update, WSUS and the Microsoft Update Catalog. The KB page lists the usual prerequisites for manual installs: the latest servicing stack update, and on Arm64 and x64 a checkpoint cumulative update installed first. It also carries forward three known issues from earlier updates, including Smart App Control sometimes refusing to turn on and some USB Audio Class 1.0 devices losing sound, none of which is caused by the certificate change.
Why it matters
For people who game and bank on the same Windows machine, the reassuring part is that the defence works without them. The risky intermediates were blocked first, and connected PCs pick up the root removal through the background service. The broader lesson is about how much the padlock depends on a few hundred organisations generating keys properly, and how quickly a mistake in one of them becomes everyone's problem.
Administrators have a short list: install the update on any disconnected or policy-restricted machines, and check whether any internal systems rely on certificates that chain to the removed eMudhra roots, since those will need replacing. Microsoft says organisations with specific compatibility needs can trust a certificate locally after their own security review. The next step on Microsoft's side is the outcome of its investigation into eMudhra's other roots, for which it has given no date.
Reporting notes