Microsoft Defender is mistakenly identifying legitimate DigiCert root certificates as malware, triggering widespread false-positive alerts and certificate removals on Windows systems.
Microsoft Defender's threat detection engine has begun flagging DigiCert root certificates with the malware classification Trojan:Win32/Cerdigent.A!dha, creating significant disruption across enterprises and users relying on DigiCert's certificate infrastructure.
The false positives have resulted in automatic certificate removal from affected Windows systems, potentially disrupting SSL/TLS connections and authentication processes for services using DigiCert certificates. Users report alerts and quarantine actions despite the certificates being legitimate and widely trusted.
DigiCert, one of the world's largest certificate authorities, has confirmed the certificates in question are genuine and secure. The issue appears to stem from a detection signature error within Microsoft Defender's malware definitions rather than any compromise of DigiCert's infrastructure.
The incident highlights a recurring problem in security software: overly aggressive or poorly calibrated detection rules can disable legitimate security infrastructure. Previous similar incidents have caused widespread outages when antivirus engines incorrectly flagged critical system files or trusted software.
Microsoft has not yet released an official statement addressing the scope of affected systems or a timeline for resolution. Users experiencing these false positives are advised to whitelist DigiCert certificates in Defender settings as a temporary workaround, though enterprise environments may lack granular controls for immediate mitigation.
The situation underscores the tension between security software attempting to catch emerging threats and the risk of disrupting legitimate operations. Organizations dependent on DigiCert certificates are monitoring the situation closely, as the misdetection could impact millions of systems globally.
This incident may prompt broader discussions about coordination between certificate authorities and antivirus vendors, particularly regarding pre-release testing of detection signatures against known legitimate certificates.
Two recently patched vulnerabilities in PaperCut NG and MF print management software are being actively exploited in data theft campaigns. The zero-days were patched last week after initial exploitation was discovered.
Inexpensive GPS jamming devices are proliferating globally, disrupting navigation systems across civilian infrastructure. The low cost and easy availability of these tools are creating widespread interference zones.
Devices promising free movies are recruiting home internet connections into proxy networks without users' knowledge. The trade-off: your bandwidth and privacy.
QubesOS released a security update addressing a critical vulnerability that allows arbitrary code execution through an error reporting backchannel in the copy-to-VM function. The flaw affects multiple Qubes versions.