Leaked CA Private Keys Threaten Python Ecosystem, pip Upgrade Urged

Eight weak private keys from certificate authority eMudhra were leaked, allowing attackers to impersonate trusted sites like python.org and PyPI. Python's security team urgently urges users to upgrade to pip 26.2.2 and the latest certifi.

2026-10-23 ~ 2026-10-23 · 2 related posts

• pip supply-chain alert: eMudhra's weak TLS keys exposed, upgrade to pip 26.2.2 now — TheZachMueller · 2026-10-23
• 8 CA keys compromised: Python warns devs to urgently update pip, certifi, uv — VeryWellVersed · 2026-10-23