Taiwan Information Security Association
Join TWISA
Menu

Certificate trustFri, 23 Oct 2026

Python certificate trust: update tooling in every runtime

Python advised users on October 20, 2026 to update trust data following the eMudhra/emSign intermediate CA incident. Affected trust data could let a TLS client accept an impersonated service, including package downloads.

Download PDF (Traditional Chinese)View applicable solutionsBack to Security alerts
01

Article

Python advised users on October 20, 2026 to update trust data following the eMudhra/emSign intermediate CA incident. Affected trust data could let a TLS client accept an impersonated service, including package downloads.

  • pip 26.2.2; certifi 2026.10.19
  • uv 0.13.4; conda 26.9.4; pixi 0.82.1
  • sigstore 4.5.1

pip can use bundled certifi alongside system trust. Check custom REQUESTS_CA_BUNDLE and --cert settings. Update each existing venv and do not disable certificate verification.

Response flowResponse steps
  1. 01

    Inventory runtime environments

    Include Python, venvs, CI runners, containers, managed applications and embedded tools.

    See what to doResources: 1

    TWISA member solutions

    Inventory runtime environments

    Include Python, venvs, CI runners, containers, managed applications and embedded tools.

  2. 02

    Obtain updates securely

    Use the official wheel and SHA-256 verification procedure in Python’s advisory, then update certifi and affected tools.

  3. 03

    Rebuild and redeploy

    Rebuild without old container layer caches and replace stale runner and package caches.

  4. 04

    Verify each running environment

    Check the running executable, package versions, CA source, package downloads and business TLS connections.

    See what to doResources: 2

    TWISA member solutions

    Verify each running environment

    Check the running executable, package versions, CA source, package downloads and business TLS connections.

Defense architectureLayered defenses

Allow authorized traffic and apply controls at each layer.

  1. 01

    Inventory runtime environments

    Include Python, venvs, CI runners, containers, managed applications and embedded tools.

  2. 02

    Obtain updates securely

    Use the official wheel and SHA-256 verification procedure in Python’s advisory, then update certifi and affected tools.

  3. 03

    Rebuild and redeploy

    Rebuild without old container layer caches and replace stale runner and package caches.

Feed logs and traffic data from each layer into monitoring and response.

  1. Verify each running environmentCheck the running executable, package versions, CA source, package downloads and business TLS connections.

TWISA member solutions

Sources

Alert updated: 2026/10/25.