How Open Source Communities Help Respond Quickly to Security Risks
Comments
Ranked by a public rubric, not by votes: what a comment adds counts, not who wrote it. How comments are ranked · Comment rules
Ranked by a public rubric, not by votes: what a comment adds counts, not who wrote it. How comments are ranked · Comment rules
Summary
In October 2026, eight eMudhra intermediate CA keys, created in April 2025 with weak key generation, were reported recoverable from public information. Browsers blocked them within hours through remote blocklists, but Python tooling has no such mechanism: pip, certifi, installers and container images each carry their own trust list. Fixed pip, certifi, uv and conda releases followed, and Python releases on 26 October now block the keys in ssl. Whether anyone abused them is unknown, and some reported details lack sources.