Skip to content
CHRONOSAlerts
AI & TechnologyUrgency level L4SevereActiveGlobal
CHRONOS AI & Technology category illustration. Illustrative only, not specific to this event.
CHRONOS VisualizationAI & Technology illustration, not specific to this event

Microsoft removes seven eMudhra-related certificates on Oct 26, 2026; WordPress 7.1.4 updates bundled root certificates

Event summary

On October 26, 2026 Microsoft released an out-of-band Windows update that removes seven certificates associated with the affected eMudhra hierarchies from the Windows trust list. WordPress published release 7.1.4 which updates its bundled root certificates because of the eMudhra revocation. Administrators should apply vendor updates and inventory TLS certificates to determine whether any in-use certificates chain to the affected eMudhra roots and require migration.

CHRONOS Wire · October 29 · Alert 6

1:23
Publication details
Published
Updated
Revision
r1
Source
WordPress.org
Urgency
4/5
Severe
78/100
HIGH
80/100
HIGH
40/100
LOW
75/100
HIGH
85/100
VERY HIGH

Cliff Notes

  • Apply the Oct 26 Microsoft Windows update if applicable; update WordPress installations to 7.1.4 where relevant; inventory TLS certificates and plan migration for any that chain to the affected eMudhra roots.

U.S. Impact

U.S. Impact assessment pending.

ELI5: Plain-English Explanation

Microsoft removed seven eMudhra-related root certificates from Windows on October 26, 2026. WordPress released 7.1.4 and updated its bundled root certificates because of the eMudhra revocation. Administrators should apply vendor updates and check whether deployed TLS certificates chain to the affected eMudhra roots.

Why Urgent Level 4

Microsoft and WordPress published updates within the last several days; applying available vendor updates and assessing certificate inventories promptly reduces the window of inconsistent trust behavior as other vendors and downstream projects roll out updates.

What Changed

On October 26, Microsoft released an out-of-band Windows update that removes seven certificates associated with the affected hierarchies from the Windows trust list. WordPress published the 7.1.4 release which updates its bundled root certificates because of the eMudhra revocation.

What Is Genuinely New

Microsoft removed seven eMudhra-related certificates from the Windows trust list on October 26, 2026. WordPress published release 7.1.4 which updates its bundled root certificates due to the eMudhra revocation.

CHRONOS Bottom Line

Apply vendor updates such as the Microsoft out-of-band Windows update and the WordPress 7.1.4 release where relevant. Inventory TLS certificates in use and identify any that chain to the affected eMudhra roots so they can be migrated or replaced according to your operational policy.

Uncertainties / Known Unknowns

Not all platform and device vendors have published updates; some embedded systems and third-party software may continue to include the affected eMudhra roots in their bundled trust stores until separate updates are released and applied.

Detailed Analysis

Microsoft issued an out-of-band Windows update on Oct 26, 2026 removing seven certificates tied to the affected eMudhra hierarchies from the Windows trust list. WordPress published release 7.1.4 which states the bundled root certificates were updated due to the eMudhra revocation. Organizations should map deployed TLS certificates to trust anchors and apply vendor updates to clients and servers as appropriate. Some downstream software and devices may not yet have updated trust stores, so inventory and targeted mitigation planning is advised.

Sources / Evidence

  1. 01
    WordPress 7.1.4
    WordPress.org2026-10-28
  2. 02
    Microsoft’s response to compromised eMudhra certificate authority keys
    Microsoft Security Response Center2026-10-26

Follow CHRONOS ALERTS

Published alerts also appear on Instagram and Threads as @chronosalerts.

Instagram@chronosalertsThreads@chronosalerts