A security incident involving eMudhra intermediate certificates has led to the removal of the emSign CA certificate from major trust bundles used by Python projects, including certifi. In response, the Python project issued emergency releases: Python 3.15.1, 3.14.9, and 3.13.17. The aim is to ensure users obtain a fresh, trusted certificate bundle and reduce exposure to potential man-in-the-middle (MITM) attacks on TLS-enabled services such as python[.]org and pypi[.]org.
The advisory from CPython core developers emphasised that failing to upgrade could leave users vulnerable. The minimum safe versions listed include certifi 2026.10.19, pip 26.2.2, uv 0.13.4, sigstore 4.5.1, conda 26.9.4, and pixi 0.82.1; the earlier mention of certifi 2026.10.18 was superseded by 2026.10.19 to ensure compatibility with the updated emSign roots.
Notably, Python 3.13’s release was unusual in that it ships with the updated pip, given that 3.13 had entered security-only mode, and the release was described as prudent.
In addition to the Python updates, the macOS installer now uses a pre-release of Tk to address a potential hang in tkinter apps such as IDLE on macOS 27.0. Practical steps for users include installing the new Python release or upgrading pip and uv in all virtual environments, upgrading certifi (the macOS installer bundles its own copy), and rebuilding container images with layer caching disabled to pull fresh system certificates.