Skip to content
NewA calmer, faster ZeroHour
StoryAdvisorymedium

Python users discuss eMudhra/emSign CA incident without impact details

1 source · 5 articlesFirst reported Updated ()1 · 1 read
What's new

October 23: Follow-ups name virtualenv 21.14.11 and urge truststore or system stores, still without describing the certificate failure.

Merged summary · x-ai/grok-4.7 · rewritten as coverage arrivesSummaries by Vani AI

oss-security posts urge Python users toward system trust stores, but none describe the eMudhra/emSign certificate failure.

oss-security posts for Python users concern an eMudhra/emSign certificate-authority security incident, but the available text does not say what failed, which certificates or Python releases are affected, or what users should do. The original notice cites a statement by Seth Michael Larson and a comment by Christian Helms. Valtteri Vuorikoski argues packages should use a distribution ca-certificates store and depend on certifi only when necessary. Eli Schwartz points to certifi-system-store and distro packaging of pip, requests, and certifi. Sam Bull says the incident should raise priority for moving from certifi to truststore. Stuart Henderson notes virtualenv 21.14.11 vendors pip and requires python-discovery 1.6.1 or newer.

Key facts
  • Posts name eMudhra and emSign but omit failure details.
  • Seth Michael Larson’s statement and Christian Helms’s comment are cited, not quoted.
  • Vuorikoski says system ca-certificates should be the default trust source.
  • Schwartz points to projg2/certifi-system-store for distro packaging.
  • virtualenv 21.14.11 vendors pip and needs python-discovery 1.6.1 or newer.
  • Bull says the incident should prioritize truststore over certifi.
Analyze this story with Vani AIImpact, who is affected and what defenders should do, in a new chat

Timeline

dated events in the reporting · oldest first
  1. Oct 22, 2026oss-security forwards a Python notice on the CA incident. · oss-security
  2. Oct 22, 2026Vuorikoski urges system ca-certificates instead of vendored roots. · oss-security
  3. Oct 22, 2026Schwartz points users to certifi-system-store and distro packages. · oss-security
  4. Oct 23, 2026Henderson notes virtualenv 21.14.11 and python-discovery 1.6.1. · oss-security
  5. Oct 23, 2026Bull says the incident should prioritize truststore over certifi. · oss-security

What each outlet adds

beyond the shared facts
  • oss-securityFive posts cover the notice, packaging advice, virtualenv, and truststore.
Vendors
eMudhraemSign
Products
PythoncertifipipemSigntruststorevirtualenv
Organizations
eMudhra

Coverage

oldest first · one row per article · UTC
  1. · 2d ago oss-securityFirst report

    Python users pointed to eMudhra emSign CA certificate incident

    The forwarded note only cites a Python discussion statement and a comment, without describing the certificate impact.

  2. · 2d ago oss-security

    Python developer urges packages to stop vendoring CA roots

    The reply says distribution ca-certificates should be the default, with certifi used as a dependency only when necessary.

  3. · 2d ago oss-security

    Python users urged to prefer system stores after eMudhra CA incident

    The reply says distribution pip and requests should use the system certifi store.

  4. · 2d ago oss-security

    virtualenv 21.14.11 noted for Python users after emSign CA incident

    The release vendors pip and requires python-discovery 1.6.1 or newer.

  5. · 2d ago oss-security

    Python users urged toward truststore after eMudhra CA incident

    A short oss-security reply says the CA incident should raise priority for replacing certifi with truststore.