eMudhra intermediate CA private keys compromised

eMudhra publicly apologises ("The flaw was ours. A script error resulted in issuing CA’s with weak keys."), says it is commissioning an independent expert to review the incident and its controls, and will publish a full root-cause analysis through the CCADB process. It says the affected intermediates issued no publicly trusted end-entity certificates and is moving G3 and other TLS customers to alternate certificates at no cost.

Python ships expedited security releases 3.15.2, 3.14.10, 3.13.18, 3.12.16 and 3.11.18 that block the compromised eMudhra intermediate keys in the ssl module (CVE-2026-115557), so normal pip use, including upgrading pip itself, is safe from attacks using those keys even before pip is updated. 3.15.2 and 3.14.10 have binary installers; the others are source-only.