⚠️ALERT: Python warns unpatched apps could trust FAKE WEBSITES after 8 certificate keys were EXPOSED. Attackers could intercept connections, including to Python's own sites, python(.)org and PyPI. Each secret key was a number below 256, per Python core developer Christian Heimes, so anyone could work it out. Unpatched tools would show no warning, so a fake PyPI could hand you tampered packages. Apps could also hand passwords or API keys straight to an impostor, as a fake site "receives whatever those clients send," per security firm Endor Labs. There's no evidence the keys have been used in attacks so far, per BleepingComputer. Browsers are protected, as Chrome, Firefox, Microsoft and Apple have now blocked the affected certificates. If you use Python, here's how to stay safe: 1. Check your pip with "python -m pip --version" 2. Upgrade to pip 26.2.2 or later, using the secure command in Python's announcement 3. Upgrade certifi and uv too 4. Repeat in every virtual environment you use 5. Rebuild your Docker images with caching off, and upgrade pip inside them, as some official Docker Python images still ship an older version Updating your computer alone won't fix older pip, because it carries its own certificate list.