Python

eMudhra (emSign) intermediate CA keys compromised: what Python users need to do about pip, certifi and uv

On October 17, 2026, a report showed that the private keys of eight intermediate certificates from the Indian certificate authority eMudhra (six for TLS) had been generated so badly that anyone could recover them. eMudhra revoked all eight on October 18, and Chrome and Firefox blocked them on October 17 through their push mechanisms. On October 20 Mozilla decided on an emergency removal of trust in the parent root, emSign ECC Root CA - G3, and Chrome will remove it on October 27 (Pacific time). Browsers are protected, but TLS clients outside the browser can trust forged certificates until their own copy of the CA list is updated. In Python, pip always loads its vendored certifi, so an old pip stays exposed even after the OS store is fixed. The Python projects published a notice on October 20 (updated through October 22) asking users to upgrade to at least certifi 2026.10.19, pip 26.2.2, uv 0.13.4, sigstore 4.5.1, conda 26.9.4 and pixi 0.82.1 and to rebuild container images without the layer cache. On October 21 they released Python 3.15.1, 3.14.9 and 3.13.17 bundling pip 26.2.2. There will be no 3.11 or 3.12 release with a newer pip. This is not a code execution bug in CPython: an attacker who sits on the network path could redirect connections to PyPI, python.org and other sites to a fake server. No exploitation had been announced as of October 24. On October 22 eMudhra said it will exit the global SSL/TLS certificate business. This site's take: upgrade pip to 26.2.2 or later and certifi to 2026.10.19 or later in every environment, rebuild Docker images without the cache, and raise any certifi pins in lockfiles.