Install the latest JetBrains security updates now to patch CVE-2026-123294, CVE-2026-123279, and 59 other flaws across Hub, Datalore, and IntelliJ IDEA.
Google's November security update fixes a critical Android vulnerability that can interrupt cellular calls through a hidden message. Here's how to check your device.
Microsoft released emergency Windows trust updates after discovering eight recoverable eMudhra intermediate CA private keys that could let attackers forge trusted certificates or sign malicious content.
Microsoft said the issue affected eMudhra’s certificate hierarchy, not Microsoft systems. The response includes an October 26 out-of-band Windows update removing seven certificates from the Windows trust list.
Microsoft confirmed on October 27 that it had removed the same certificates from the Microsoft Edge trust list, extending its response beyond earlier blocks against the compromised intermediates.
Six affected keys relate to Transport Layer Security, or TLS, which helps protect connections to websites and services. The other two relate to code signing, which helps systems check who published software. Recovering these keys could let attackers misuse the trust attached to their certificate authorities.
An attacker using a compromised TLS key could create a certificate to impersonate a website or service and potentially intercept communications. The code-signing keys could make malicious software appear to come from a trusted publisher. These are potential uses of the keys, not proof that such attacks occurred.
Microsoft first updated the Windows Disallowed Certificate Trust List on October 20 to block the affected certificate authorities. It also deployed a separate CRLSet update for Edge and WebView2 to block affected TLS certificates. That browser protection arrives automatically through component updates without requiring a new browser version.
The later Windows update removes six eMudhra G3 root certificates and an AAA Certificate Services cross-sign. Removing these seven certificates is a broader trust decision, separate from blocking the eight compromised intermediate keys and from eMudhra’s revocation of the affected intermediate certificates.
Microsoft warned against restoring trust locally without assessing the risks. Software that does not reliably check certificate revocation or Microsoft’s disallowed list could still accept certificates linked to the compromised intermediates if the removed trust is retained or restored.
Organizations should allow Windows certificate trust updates and Edge component updates to reach managed devices. Disconnected Windows systems need special attention because administrators must provide an alternative way to update.
Microsoft also urged customers to review disconnected Azure virtual machines and Virtual Machine Scale Sets. Updated images are available through Azure Marketplace.
Certificate owners should identify chains that depend on the seven removed certificates and obtain replacements or an alternative trusted chain.
Microsoft is evaluating remaining eMudhra roots separately as customers move away from affected hierarchies. Administrators can monitor Microsoft Trusted Root Program announcements for published changes and verify that certificate updates reach every managed system.
The OnePlus Nord 6 will receive six years of security updates but only four generations of Android upgrades. Here’s how that split could affect app compatibility, device management, and long-term purchasing decisions.
Google is testing twice-weekly Chrome security updates as AI tools uncover more vulnerabilities and the company works to shrink the browser’s patch gap.
Security researchers warn hackers are actively exploiting two patched WordPress Core vulnerabilities that could let attackers fully compromise unpatched websites.
Entrar
