The Python language itself hasn't been compromised, but there were a few security incidents this week in the Python ecosystem, and one needs action if you use it.
The LiteLLM package (urgent if you installed it). On October 21, 2026, a malicious version, 1.107.0, of the LiteLLM Python package was published to PyPI and to Docker images. Attackers got into the release pipeline. The malware was a credential stealer that targeted cloud logins, SSH keys and AI service keys, and it could run whenever Python started in an affected environment, even if LiteLLM was never imported. PyPI removed the version within a couple of hours. Anyone who installed an unpinned LiteLLM in that window should move to a clean version (reports say 1.106.2), and rotate their cloud and API keys. Help Net Security and The Hacker News both cover it. The exact exposure window and the fix are in the vendor's own advisory, which the reports link to.
Certificate trust in pip and Python. A separate advisory from the Python community says some eMudhra intermediate certificates used weak elliptic-curve keys. The fix is an update to pip (26.2.2 is named in one summary) that clears the affected trust store. Check the Python discussion post before relying on that version number.
SAP's Python SDK. SAP's October security update fixed a maximum-severity flaw (CVE-2026-89111) in its Cloud SDK for Python that could leak OAuth2 client credentials. If you use that SDK, update it.
For the general case, install packages from known sources, pin versions, and keep Python and pip current.
🕒 As of October 2026
Grok seems to think it is critical:
This is a real, critical issue (GHSA-6q48-6c7w-9gw2, CVSS 9.1). The tweet accurately describes it.
What’s happening
Certifi (and tools that bundle it, especially pip and uv) included the emSign ECC Root CA - G3. Eight eMudhra intermediate certificates chaining to that root had extremely weak private keys (ECC scalars , some as low as 4). Those keys were effectively crackable, so an attacker who is on the network path can forge certificates for any hostname and perform man-in-the-middle (MITM) attacks against clients that still trust the old bundle.
Affected clients include pip, requests, urllib3, the official python.org macOS installers, and anything else that uses an older certifi bundle. OS-level CA updates alone do not protect older pip, because pip always loads its vendored certifi in addition to the system trust store and there is no supported way to disable that.
Official recommended versions
- pip ≥ 26.2.2
- certifi ≥ 2026.10.19
- uv ≥ 0.13.4
- Python interpreters that already ship the fix: 3.15.1, 3.14.9, 3.13.17
Patching plan
1. Upgrade pip safely first (critical — do this in every environment)
Use the official pinned wheel + SHA-256 so the upgrade itself cannot be MITM’d:
python -m pip install "pip @ https://files.pythonhosted.org/packages/3f/06/3e4420302363fbb71be3c7f35ce042f54bfca330e3e66b3a2e3c4cca579f/pip-26.2.2-py3-none-any.whl#sha256=fd7f4dfa8190e014013b9f08f3e973f4e4c26ffd179a204895533a7254813a70"2. Then upgrade certifi and uv with the new pip
python -m pip install --upgrade certifi
python -m pip install --upgrade uv3. Do this for every virtual environment
Old venvs keep their own copies of pip/certifi. Activate each one and run the commands above.
4. Python interpreter / installer upgrades
- Prefer upgrading to Python 3.15.1 / 3.14.9 / 3.13.17 (they bundle the fixed pip + certifi).
- On macOS with the official python.org installers, also run the path-specific commands from the official Python announcement.
5. Docker / containers / CI images
Rebuild images with layer caching disabled so they pull the updated packages and any refreshed system CA bundles. Existing images retain the vulnerable certifi.
6. Verification
python -m pip --version # should be ≥ 26.2.2
python -c "import certifi; print(certifi.__version__)" # should be ≥ 2026.10.19
# Optional: confirm the bad root is gone
grep -c "emSign ECC Root CA - G3" "$(python -c 'import certifi; print(certifi.where())')"7. Additional notes
- For uv users who want to rely on the system store: set UV_SYSTEM_CERTS=true after the OS has distrusted the bad intermediates.
- If you use sigstore, update to ≥ 4.5.1.
- Update your OS CA store as well (Ubuntu, Debian, Alpine, etc. have published packages), but remember it is not sufficient by itself for older pip.
The official guidance is on the Python Discourse thread linked above and on the Python Insider blog. Patch promptly—especially any environments that can download packages or make TLS connections to sensitive endpoints.
grok.com/share/bGVnYWN5LWNvcHk_1b4936de-c6ba-4aff-bd4f-be3ea735409d
Updated October 2026: The LiteLLM advice still holds, and the certificate item is now confirmed by several sources, though the severity rating differs between them.
For LiteLLM, the bad release is 1.107.0, published October 21. Wiz, Datadog and Brandefense name 1.106.2 as the latest clean version (OX Security says 1.106.0, so 1.106.2 is the safer pin). If 1.107.0 ran anywhere, Datadog's guidance is to delete cook.pth, cook.py and sitecustomize.py from site-packages, then rotate credentials from a clean machine. Socket warns that a file named sitecustomize.py can be legitimate, so check its contents before deleting it.
The certificate issue (GHSA-6q48-6c7w-9gw2) is real. Eight eMudhra intermediate certificates under the emSign ECC Root CA - G3 had weak keys that could be recovered, and the CA has revoked them. The fixed versions are certifi 2026.10.19, pip 26.2.2 and uv 0.13.4. On severity, the GitLab mirror of the advisory lists 7.4 High, while another write-up says GitHub rates it critical. I could not confirm the 9.1 score Grok gave, so check the advisory itself. The attack needs someone on your network path, who could then pose as any website.
Because pip checks both the system store and its bundled certifi, updating only the OS does not fix it. Upgrade pip, then check:
python3 -m pip install --upgrade pip
python3 -m pip --version
python3 -m pip show certifi
grep -c "emSign ECC Root CA - G3" "$(python3 -m certifi)"The last line should print 0. I did not verify Grok's Python interpreter versions (3.15.1, 3.14.9, 3.13.17) or its wheel link, so use the official Python announcement for those. Mozilla removed the root in NSS 3.131.1, and Chrome's removal is expected October 27. I have not rechecked the SAP SDK item.
🕒 Updated October 2026
