Microsoft hits record 1,400+ patches while eMudhra CA keys suffer catastrophic failure

October's Microsoft Patch Tuesday saw a record 1,400+ vulnerabilities addressed, including 78 critical bugs. Simultaneously, the eMudhra Certificate Authority issued intermediate certificates with extremely weak, easily brute-forced private keys, forcing rapid responses from Chrome and Mozilla. While browsers responded quickly, the compromise poses long-term risks for IoT devices and software that does not check certificate revocation.

Security Roundup: Microsoft Patches and CA Compromise

• Microsoft Patch Tuesday: Over 1,400 vulnerabilities fixed; 78 rated critical, many allowing remote code execution.
• CVE-2026-96951: A Windows Shell security feature bypass currently being exploited in the wild.
• eMudhra CA Failure: Eight intermediate certificates (TLS and code-signing) had private keys consisting of tiny integers (e.g., 4, 56, 230), making them trivial to recover.
• Mitigation: Chrome and Mozilla have blocked the affected certificates; Go language has hard-coded the bad keys into its standard library (CVE-2026-111943).

Why it matters

The massive volume of Microsoft patches, attributed to LLM-driven bug hunting, increases the burden on system administrators, while the eMudhra incident highlights the danger of weak key generation in the global trust chain.