Earlier last week, Microsoft announced that PKI infrastructure company eMudhra had suffered a compromise of six of its intermediate certificate authority (CA) private keys, used to authenticate TLS connections: https://www.microsoft.com/en-us/msrc/blog/2026/10/microsoft-response-to-compromised-emudhra-certificate-authority-keys.
Why this matters
A certificate created with one of these keys would look legitimate to browsers, operating systems, and SDKs, even though eMudhra never authorized it. The six TLS keys could be used to impersonate a website or service and potentially intercept users' communications. Blocking the affected certificate authorities promptly means certificates created with these keys are no longer trusted.
Removing roots from Azure Sphere SDK trust lists
Whilst this was not a compromise of Microsoft's systems, one of the python components used within the Azure Sphere SDK took trust on these certificates. As such, we're releasing an interim SDK version 26.06.01 to address any risks associated with this.
We recommend customers download and install the latest SDK as a priority, for any connected systems:
