# Update Python tooling after the eMudhra certificate incident

> Update pip and certificate bundles in each environment; an operating-system update alone is insufficient.

Source: https://fullbytedeveloper.com/blog/python-emudhra-certificate-update
Published: 2026-11-05

Older pip installations can still trust the affected eMudhra certificates after an operating-system update. The Python security team explains that pip also loads its bundled certifi store. [1]

## Update pip in each environment

Activate each existing virtual environment. The advisory supplies this wheel URL and checksum to bootstrap a fixed pip installation. [1]

```bash
python -m pip install "pip @ https://files.pythonhosted.org/packages/3f/06/3e4420302363fbb71be3c7f35ce042f54bfca330e3e66b3a2e3c4cca579f/pip-26.2.2-py3-none-any.whl#sha256=fd7f4dfa8190e014013b9f08f3e973f4e4c26ffd179a204895533a7254813a70"
```

## Check the current advisory before rebuilding

The advisory now recommends at least certifi 2026.10.19, pip 26.2.2 and uv 0.13.6. It also lists updated Python releases, including 3.15.2, 3.14.10 and 3.13.18. These recommendations supersede the older versions in the video. [1]

Rebuild container images with layer caching disabled so the system certificate packages are refreshed. Review the advisory's separate instructions for macOS framework installations and other packaging tools you use. [1]

Updating one environment leaves the others untouched. Keep the advisory beside your environment list until every installation and rebuilt image has been covered.

## Sources

1. [Python security team: eMudhra certificate incident](https://discuss.python.org/t/information-for-python-users-regarding-emudhra-emsign-ca-certificate-security-incident/109576/1)

## Original posts

- [YouTube Short](https://www.youtube.com/shorts/6S6r43dV91Y)