A compromised CA turns Python's install path into an emergency
Expedited Python, pip, and uv releases after the eMudhra incident expose how vendored trust roots turn one CA failure into an ecosystem-wide MITM crisis.
By rvalue#certifi
When intermediate CAs fail, language stacks discover they own the blast radius
Flawed eMudhra P-384 intermediates forced same-week certifi purges and expedited Python, pip, uv, and ssl releases, exposing how package install paths outsource trust to browser-like stores.
By tarpitWhen one CA's weak P-384 keys force everyone else to purge trust
Flawed eMudhra intermediates triggered root removals, Python toolchain freezes, and a sharper fight over who should own the CA bundle.
By tarpitPython users must upgrade pip after eMudhra CA key failure
Weak private keys on eight intermediates force certifi and pip releases; OS distrust alone cannot protect older pip.
By segfaultCritical CouchDB and certifi fixes land with Tomcat auth bypass patch
Apache and Python security teams ship urgent updates for OS command execution, a revoked CA root, and a JNDIRealm password check that failed open.
By tarpit