Do Son 
A security incident involving eMudhra intermediate certificates has forced the removal of the emSign CA certificate from popular trust bundles such as certifi. In response, the Python team pushed out expedited releases: Python 3.15.1, 3.14.9, and 3.13.17.
Why the emSign CA certificate was pulled
CPython core developer Seth Michael Larson urged users to act fast. “Failure to do so could result in monster-in-the-middle (MITM) attacks against TLS clients, including python.org and pypi.org,” he warned.
His advisory for Python users on the eMudhra incident lists the minimum safe versions:
- certifi 2026.10.19
- pip 26.2.2
- uv 0.13.4
- sigstore 4.5.1
- conda 26.9.4
- pixi 0.82.1
Notably, the advisory first named certifi 2026.10.18. However, 2026.10.19 is now recommended because it keeps unaffected emSign roots working.
A rare Python security release for 3.13
All three new builds bundle pip 26.2.2, which ships the fixed certifi. Fellow core developer Hugo van Kemenade explained the 3.13 decision in the announcement of Python 3.15.1, 3.14.9, and 3.13.17. “We don’t normally update pip for security releases like Python 3.13,” he wrote. Yet since 3.13 had just entered security-only mode, a special release “seemed prudent.”
Separately, the macOS installer now uses a pre-release of Tk. This fixes a possible hang in tkinter apps, such as IDLE, on macOS 27.0.
What users should do
- Install the new Python release, or upgrade pip and uv in every virtual environment.
- Upgrade certifi, since the python.org macOS installer bundles its own copy.
- Rebuild container images with layer caching disabled to pull fresh system certificates.
In short, removing the emSign CA certificate only protects you once your tools pick up the new bundle.
Support Our Threat Intelligence
Find our tech and OS security coverage helpful? Support our work today and unlock a 100% ad-free reading experience!
Buy Me a Coffee
