A certificate authority incident is a trust-store problem, but not every application uses the same trust store.

Cloudflare reported that private keys associated with eight eMudhra intermediate certificates were compromised: six used for TLS and two for code signing. If a trusted certificate key is exposed, attackers may be able to create certificates or sign content that appears to chain to a trusted authority. Microsoft’s October 26 response explicitly says the issue was in eMudhra’s certificate hierarchy, not a compromise of Microsoft systems.

The response has several layers. Microsoft described updates to the Windows Disallowed Certificate Trust List, an Edge/WebView2 CRLSet, and an out-of-band Windows update removing seven certificates associated with the affected hierarchies.…