eMudhra / emSign CA Compromise: What Python, pip, and CI/CD Users Need to Update

On October 20, 2026, Python's security team issued an advisory urging users to update Python packaging tools due to a compromise involving eMudhra/emSign CA intermediate certificates. The private keys for these intermediate CAs were generated with insufficient randomness, allowing potential attackers to forge certificates and impersonate HTTPS services during dependency downloads. This could enable man-in-the-middle attacks against tools like pip, uv, and conda that rely on certificate validation when fetching packages. Remediation requires updating to specific patched versions of certifi, pip, uv, conda, and other tools to ensure the affected certificate chains are no longer trusted.

AI-extracted · verify before operational use