Executive summary
I just read a post from the Python Software Foundation about the eMudhra intermediate CA compromise incident announced on October 20, 2026, and how the PSF security team along with many maintainers patched the Python ecosystem within two days. What I find interesting isn't just the timeline, but how this incident exposed a structural gap: tools like pip and uv turned out to have no mechanism equivalent to a browser's CRL to respond quickly without a software update.
The problem being solved
The gist: certifi is a Python package that repackages Mozilla's root CA bundle, used by pip and requests. Because certifi only stores root CAs (not intermediates), the only way to distrust the entire compromised intermediate certificate is to revoke its own root CA, namely "emSign Root TLS CA - G3". The problem then becomes a chain reaction: pip bundles requests which depends on certifi, and Python bundles pip via the ensurepip mechanism every time a new virtualenv is created. So Python, pip, and certifi all sit on the critical path for mitigation via an ordinary software update. For old Python versions stuck with old pip versions for compatibility reasons, there's no easy update solution.
Key features and examples
The main advisory is GHSA-6q48-6c7w-9gw2 for certifi. In addition, Python added a "last-resort denylist" at the TLS handshake level to reject the compromised intermediate certificate, tracked as CVE-2026-115557, and this has already been backported to older Python versions. Other components that received patches include pip, uv, sigstore, virtualenv, conda, pixi, manylinux, and gh-action-pypi-publish. All services managed by the PSF, including PyPI, the Python release process and build bots, and python.org, have been patched and had their containers rebuilt with the correct certificate set.
The article doesn't give any code examples, so here's a simple illustration to make sure your environment is using a patched certifi version:
python -m pip install --upgrade certifi pip
python -c "import certifi; print(certifi.where())"Impact and upgrade notes
If your project depends on certifi, pip, or sigstore, make sure you've upgraded to the patched versions — especially if you're still using an old virtualenv created before this incident. The PSF also recommends subscribing to the security-announce mailing list for advisories on Python, pip, and similar future incidents. Going forward, the PSF is looking at the possibility of integrating a certificate revocation mechanism like CRL (already used by browsers) into Python, and mentions the upki project — already adopted by Ubuntu — as a worthwhile candidate to watch for providing similar revocation functionality at the system level.
---
First announced on Python Software Foundation. Read the original source for full details.