pip supply-chain alert: eMudhra's weak TLS keys exposed, upgrade to pip 26.2.2 now
TheZachMueller · x · 2026-10-23
A supply-chain security incident is hitting the Python ecosystem: Indian certificate authority eMudhra (emSign) was found using absurdly weak private keys for TLS certificates — only 8 keys, all below 256, with one valued at 4. Anyone can forge a valid certificate for any site.
The direct threat to Python users: an attacker on the same network (public WiFi, ISP, or state actor) can impersonate PyPI, making pip install download trojanized packages with zero warnings. No confirmed attacks yet, but the risk is real.
Urgent fixes:
- Upgrade pip to 26.2.2+ globally (python -m pip install --upgrade pip), in every venv
- uv users: uv self update (0.13.4+)
- Update system CA certificates (apt/dnf upgrade ca-certificates) and rebuild Docker images
Any ML/AI workflow relying on PyPI is affected — audit now.
More from Safety
- Crime group used Claude, Grok and Kimi agents to attack 400+ banks in Latin America — anshulkundaje · 2026-10-23
- Greg Brockman: AI makes hacking 100x more profitable and easier, upending hacker economics — gabriel1 · 2026-10-23
- Account hacks surge: 6-step emergency checklist plus an AI audit prompt — petergyang · 2026-10-23
- For consumer AI founders, 'When are you launching in Europe?' is the new 'When Android?'—only 100x worse — omooretweets · 2026-10-23
- mmitchell_ai questions whether the AI safety vs security framing stems from EA — mmitchell_ai · 2026-10-23
- MPI-Sec PhD Thesis on Vulnerability Detection Benchmarks Includes Pre-LLM Classic "Top Score on the Wrong Exam" — mboehme_ · 2026-10-23