eMudhra intermediate CA private keys compromised

Microsoft goes further than blocking the eight intermediates: its October 26 out-of-band updates (KB5134133 for Windows 11 24H2/25H2/26H2, KB5134125 for Windows 10 21H2/22H2) remove seven certificates tied to the affected hierarchies, six eMudhra G3 roots and an AAA Certificate Services cross-sign, from the Windows trust list, and the same seven come off the Edge trust list on October 27. Microsoft says admins should install the update on disconnected systems, find certificates that depend on the removed roots and replace them, and that it is still reviewing the remaining eMudhra roots.