Changes.Watch~ upgrade verdicts ~
Free digest
CriticalPHP2Shell: is your PHP patched?

critical vulnerability

uv's bundled CA store trusts an emSign root whose intermediate CA keys are compromised

Fix availableCritical · CVSS 9.1

Published Oct 20, 2026 · updated Oct 20, 2026

What to do

  1. Upgrade to a fixed version: uv 0.13.4.
  2. Redeploy and restart long-running processes so they load the fixed code.

Affected packages

PyPIuv

Vulnerable versions
< 0.13.4
Fixed in
0.13.4

Check your project: pip show uv

What changed

  1. Oct 20, 2026

    Published in the GitHub Advisory Database as critical.

Sources

CWE-295 Improper Certificate Validation

← All critical vulnerabilities