Microsoft calendar
This Week in Security: Record Patch Tuesday, PHP’s Rough Patch, the Oldest Vulnerability, AI Armies, and More, Microsoft closed more than 1,400 vulnerabilities in one go. The previous record came in September. The roughly 1,000 vulnerabilities in September set the previous record, reaching about ten times the normal monthly average, and according to Tenable, Microsoft surpassed 4,000 CVEs with two months left in the year.
Only one of the vulnerabilities is currently being exploited, and that is CVE-2026-96951, a Windows Shell security feature bypass vulnerability affecting Windows 10, 11, and some Server versions.
Windows words
CVE-2026-108398 had previously been publicly disclosed. At least 78 vulnerabilities are rated “critical,” and most allow remote code execution without user interaction. Most allow remote code execution. Microsoft quietly extended free updates for Windows 10 until October 2027. The company attributes this to LLMs.
TLS statements
According to Fortra’s analysis, only 26 Microsoft vulnerabilities have entered the CISA KEV catalog this year, and administrators are recommended to use this catalog for prioritization.
Meanwhile, it emerged that the private keys of eight intermediate certificates — six TLS, two code-signing — belonging to the Indian certificate authority eMudhra (emSign) had been compromised. The certificates were chained to the emSign ECC Root CA – G3, which is trusted by Chrome, Apple, and Mozilla. A researcher named “Wayne” proved the situation by signing messages with the keys. According to what Flüpke shared on Mastodon, the secret value of the “EM OV TLS CA – G3C” key was only 4; the others were also cracked in a short time:
The list showing the secret values of the keys, which Flüpke shared on Mastodon, contained the following six entries in the same order and in their original format.
Timeline of the keys
The list consisted of six values. – 56 – 230 – 237 – 115 – 155 – 156 – 66
It was stated that the keys could be derived from publicly available certificates from the moment they were created in April 2025. The blocking action came swiftly. According to The Hacker News, Chrome issued a block within two hours, while Mozilla blocked the certificates in under three hours, removed the root from NSS, and released a Firefox update (CVE-2026-113470).