Python Developers Must Upgrade certifi, pip, and uv Immediately Following eMudhra TLS Compromise

While web browsers automatically revoked trust in eight compromised intermediate TLS certificates issued by Indian certificate authority eMudhra this week, backend developers face a hidden trap: Python environments often bundle their own root certificate store. As documented by Simon Willison, emergency updates have shipped for certifi, pip, and uv.

Why Weak 3-to-8-Bit Private Keys Triggered an Immediate Revocation

According to Dark Reading, a procedural flaw resulted in eight eMudhra intermediate CA certificates being generated with trivially factorable private keys of just 3 to 8 bits—six of which were capable of issuing TLS certificates for arbitrary websites.

Exact Python Package Versions Required Today

• certifi 2026.10.19: Removes the compromised root/intermediate trust anchors used by requests, httpx, and urllib3.
• pip 26.2.2: Bundles the updated certificate list to protect package downloads from PyPI.
• uv 0.13.4: Updates the high-speed Rust-based Python package and project manager with the clean trust store.

Updating your host operating system does not update the certifi bundle pinned inside your Python virtual environments or Docker layers.

Auditing CI/CD Pipelines and Pinned Requirements Files

Run pip install --upgrade certifi pip and uv self update across all build runners, and update requirements.txt or uv.lock files in active repositories.

Considering System Trust Stores via truststore

Developers can also evaluate the truststore library to delegate TLS verification directly to the underlying OS certificate store. Full primary documentation is available via Simon Willison's Technical Advisory on eMudhra and Python.