If your project uses Python, check its package tools even after updating your computer. The Python security announcement says older versions of pip can still trust compromised eMudhra certificates even after your operating system’s certificate list has been updated. Pip installs the packages a Python app depends on, including when a coding agent runs the installation for you.

The problem affects how software checks that it is talking to the real website. A certificate authority vouches for a site’s identity. A flaw made the secret signing keys for eight eMudhra certificates recoverable from the public certificates. Those keys could let an attacker create fake website certificates that unpatched software accepts as real.

A browser update does not cover every tool

The incident tracker says browser vendors have blocked the compromised certificates. Many other programs do not receive those revocation updates and need separate software updates. That includes applications and libraries which carry their own certificate lists.

The flawed keys date to April 2025. The tracker reports no certificates issued through the affected intermediates in public certificate logs before the incident came to light. Browsers that require certificates to appear in those logs would reject unlogged certificates. Other software can accept them, so attacks against that software remain unknown.

An October 20 developer write-up highlighted the Python updates. An agent uses those same package tools, so its installations need the same fixes.

Check the project’s Python tools

The Python announcement recommends at least these versions:

  • pip 26.2.2, the package installer.
  • uv 0.13.4, a tool for managing Python projects and packages.
  • certifi 2026.10.19, a package containing trusted certificates used by Python software.

Update the tools your project actually uses. Upgrade pip in each existing project environment, the isolated set of Python packages used by that project. Update uv wherever it is installed, and update certifi in applications that use it. Pip includes its own copy of certifi, so updating certifi elsewhere does not fix pip.

If uv also installed Python for your project, use uv 0.13.5 or later and follow Astral’s guidance for updating that Python installation. Existing project environments still need their separate pip update.

For the first pip upgrade, use the command containing a SHA256 checksum in the Python announcement. The checksum verifies the downloaded file against its expected contents, so the upgrade does not rely solely on the affected certificate checks.

If you deploy using a container image, a reusable package of your app and the software it needs, rebuild it without reusing cached build layers. Those saved build steps can retain an old certificate list. Update the operating system’s certificate packages too, including ca-certificates on affected Linux systems.

Ask your coding agent to identify the Python tools and project environments it uses, apply the relevant updates, and report the resulting versions. Have it flag anything still below the recommended versions, including environments it could not update.

End of article