Changes.Watch~ upgrade verdicts ~
Free digest
CriticalPHP2Shell: is your PHP patched?

critical vulnerability

certifi bundles emSign root CAs with compromised intermediate CA keys

Fix availableCritical · CVSS 9.1

Published Oct 20, 2026 · updated Oct 20, 2026

What to do

  1. Upgrade to a fixed version: certifi 2026.10.19.
  2. Redeploy and restart long-running processes so they load the fixed code.

Affected packages

PyPIcertifi

Vulnerable versions
>= 2019.03.09, < 2026.10.19
Fixed in
2026.10.19

Check your project: pip show certifi

What changed

  1. Oct 20, 2026

    Published in the GitHub Advisory Database as critical.

Sources

CWE-295 Improper Certificate Validation

← All critical vulnerabilities