Let’s connect
Back to the notebook
IT & Security2 min read

Python certificate incident: updating the interpreter is only part of the fix

The October 21 releases refresh bundled pip. Existing virtual environments and CI images still need their own checks.

What changed

Python released 3.15.1, 3.14.9 and 3.13.17 with bundled pip 26.2.2 and certifi 2026.10.19, responding to the eMudhra/emSign certificate incident. The Python security guidance also lists uv 0.13.4 as a minimum update for uv users.

Who should check

A certificate-trust incident concerns HTTPS verification by development tools. An older virtual environment can retain its own pip and trust bundle after the system interpreter changes. Updating only the operating system certificates does not reliably update pip’s bundled certificates.

What to do

  • Inventory each project environment, CI image and package installer separately.
  • Follow the official checksum-pinned pip bootstrap instructions linked below, then update the other affected tools and certificates according to vendor guidance. Keep TLS verification enabled.
  • Refresh container certificates and rebuild without stale package layers. Test package installation and the application’s outbound HTTPS in staging.

Reference commands

Inventory each activated virtual environment
python --version
python -m pip --version
python -m pip show certifi

Verify the result

Record the versions inside each environment actually used by your project. Check both application certifi and pip’s bundled trust; the inventory commands alone do not establish that every trust store has been refreshed.

Official sources

Take it into your project

Get the files, keep the guide, or give your coding assistant a ready-to-use brief.

Download guideMarkdownDownload AI setup briefEnglish · Markdown

Set it up with AI

Copy this English prompt into your coding assistant. It includes the article, available files and project setup steps.

View the setup prompt
AI setup prompt · English
Read this news or bug-fix article as reference material:
https://nethanelfitoussi.com/article/python-october-2026-certificate-update?lang=en

Goal: apply the documented workflow to my development project.
Read the existing project instructions, inspect the relevant files and explain the smallest useful setup.

Use the article and its examples as references. Identify any missing project files before making changes.

If I have not supplied a project folder, ask which development project to use. Do not invent a repository URL.

Additional project setup instructions:
Review my Python project using https://blog.python.org/2026/10/python-3151-3149-31317/ and https://discuss.python.org/t/information-for-python-users-regarding-emudhra-emsign-ca-certificate-security-incident/109576 . Inventory all virtual environments, CI images, pip, certifi, optional uv and system CA bundles. The October 21 Python releases are 3.15.1, 3.14.9 and 3.13.17; incident guidance lists pip 26.2.2, certifi 2026.10.19 and uv 0.13.4 as minimums for those tools. Verify current vendor instructions. Use the official checksum-pinned pip bootstrap procedure; do not invent a wheel URL or checksum. Do not disable TLS, use --trusted-host, or assume replacing the interpreter updates old virtual environments. Propose local compatible updates and tests, preserve lockfiles, and stop before production changes.

Check the dated advisory and current official vendor guidance. Identify whether my installed version and configuration are affected before proposing a fix.

Give me a short plan, then make the agreed local changes and run the relevant checks. Report actual results and anything not verified. Stop before credentials, paid services, production changes, push, merge or deployment.
The prompt
Review my Python project using https://blog.python.org/2026/10/python-3151-3149-31317/ and https://discuss.python.org/t/information-for-python-users-regarding-emudhra-emsign-ca-certificate-security-incident/109576 . Inventory all virtual environments, CI images, pip, certifi, optional uv and system CA bundles. The October 21 Python releases are 3.15.1, 3.14.9 and 3.13.17; incident guidance lists pip 26.2.2, certifi 2026.10.19 and uv 0.13.4 as minimums for those tools. Verify current vendor instructions. Use the official checksum-pinned pip bootstrap procedure; do not invent a wheel URL or checksum. Do not disable TLS, use --trusted-host, or assume replacing the interpreter updates old virtual environments. Propose local compatible updates and tests, preserve lockfiles, and stop before production changes.
Read the original sourcePython Insider · 21 October releases
PythonpipTLSCertificates

Keep exploring

LLM, RAG or AI agent? Understand the differences, then build the same practical case project screenshot
AI21 min

LLM, RAG or AI agent? Understand the differences, then build the same practical case

A detailed guide to what a model knows, what retrieval adds and how an agent uses tools. Follow one event-support request from a general answer to an evidence-backed answer and a controlled local draft, with diagrams, English prompts and a runnable project.

LLM / RAG
Build a PDF-reading RAG with n8n: an exhibitor copilot, step by step with screenshots project screenshot
AI17 min

Build a PDF-reading RAG with n8n: an exhibitor copilot, step by step with screenshots

Create an assistant that combines an event programme, exhibitor guide and venue information into a useful arrival briefing. A complete walkthrough with real n8n screenshots, sample PDFs, importable workflows, local AI and source checks.

n8n / RAG
Triage vulnerable dependencies with AI without blindly forcing an update project screenshot
IT & Security4 min

Triage vulnerable dependencies with AI without blindly forcing an update

Read an npm audit report, separate severity from reachability and verify one compatible change. Includes a fictional report and five tests.

Dependency audit / npm