# Python Developers Must Upgrade certifi, pip, and uv Immediately Following eMudhra TLS Compromise

> Following the compromise of 8 eMudhra intermediate TLS certificates with 3-to-8-bit keys, Python maintainers released certifi 2026.10.19, pip 26.2.2, and uv.

- **Publisher**: Egy Monitor (https://egymonitor.com/en)
- **Original URL**: [https://egymonitor.com/en/posts/python-upgrade-certifi-2026-10-19-pip-uv-emudhra-tls-certificates](https://egymonitor.com/en/posts/python-upgrade-certifi-2026-10-19-pip-uv-emudhra-tls-certificates)
- **Category**: [Web Hosting & Dev](https://egymonitor.com/en/categories/web-hosting-dev)
- **Author**: عبدالرحمن شوقي
- **Published Date**: 2026-10-23 08:52
- **Keywords**: Python, certifi, pip, uv, eMudhra TLS

---

While web browsers automatically revoked trust in eight compromised intermediate TLS certificates issued by Indian certificate authority **eMudhra** this week, backend developers face a hidden trap: Python environments often bundle their own root certificate store. As documented by [Simon Willison](https://simonwillison.net/2026/Oct/20/emudhra-certificates/), emergency updates have shipped for **certifi**, **pip**, and **uv**.

## Why Weak 3-to-8-Bit Private Keys Triggered an Immediate Revocation

According to [Dark Reading](https://www.darkreading.com/cyber-risk/tech-giants-emudhra-certificates-compromised-keys), a procedural flaw resulted in eight eMudhra intermediate CA certificates being generated with trivially factorable private keys of just 3 to 8 bits—six of which were capable of issuing TLS certificates for arbitrary websites.

### Exact Python Package Versions Required Today

- **certifi 2026.10.19:** Removes the compromised root/intermediate trust anchors used by `requests`, `httpx`, and `urllib3`.
- **pip 26.2.2:** Bundles the updated certificate list to protect package downloads from PyPI.
- **uv 0.13.4:** Updates the high-speed Rust-based Python package and project manager with the clean trust store.

> Updating your host operating system does not update the certifi bundle pinned inside your Python virtual environments or Docker layers.

## Auditing CI/CD Pipelines and Pinned Requirements Files

Run `pip install --upgrade certifi pip` and `uv self update` across all build runners, and update `requirements.txt` or `uv.lock` files in active repositories.

### Considering System Trust Stores via truststore

Developers can also evaluate the `truststore` library to delegate TLS verification directly to the underlying OS certificate store. Full primary documentation is available via [Simon Willison's Technical Advisory on eMudhra and Python](https://simonwillison.net/2026/Oct/20/emudhra-certificates/).