| Engineering | Previously Finance | Previously Physics
Ad Abyssum, Ut Ad Astra Eamus
Joined January 2009
- Tweets25.4K
- Following857
- Followers1.3K
- Likes4.6K
pystar retweeted
🚨 BREAKING: LINUX IS NOW FACING TWO CRITICAL SECURITY VULNERABILITIES, AND THERE ARE NO OFFICIAL KERNEL FIXES YET.
Both rated 9.0/10 in severity.
One could allow hackers to take control of vulnerable servers WITHOUT EVEN LOGGING IN.
And the most alarming part? The flaws were made PUBLIC before patches were ready.
Here's what's happening:
→ TWO CRITICAL RCE FLAWS: Both affect KSMBD, Linux's built-in SMB file server.
→ NO PASSWORD REQUIRED: One vulnerability could allow unauthenticated attackers to execute malicious code on vulnerable servers.
→ KERNEL-LEVEL ACCESS: Successful exploitation could potentially give attackers control within the Linux kernel itself.
→ NO MAINLINE PATCH YET: Both vulnerabilities were publicly disclosed before official kernel fixes were available.
→ DISCOVERED BY AI: Trend Micro's AI-powered security scanner identified the flaws.
→ SERVERS AT RISK: Linux systems running the vulnerable KSMBD service need immediate attention, especially if port 445 is exposed.
First PHP. Then Node.js. Then GitLab. Then Python.
NOW LINUX.
And this time, the vulnerabilities are PUBLIC before the fixes are ready.
If you manage Linux servers, CHECK YOUR EXPOSURE NOW.
🚨 BREAKING: IT JUST KEEPS GETTING WORSE. NOW PYTHON IS FACING A MASSIVE SECURITY EMERGENCY.
Python's security team has issued an URGENT warning after a certificate authority compromise put Python's HTTPS security at risk.
→ 8 CERTIFICATE AUTHORITY KEYS COMPROMISED. Some were so weak they could be cracked almost INSTANTLY.
→ FAKE TRUSTED WEBSITES: Attackers could potentially impersonate Python.org, PyPI and other websites during intercepted connections.
→ MALICIOUS DOWNLOADS: Vulnerable environments could be tricked into downloading software from attacker-controlled servers.
→ YOUR OS PATCH MAY NOT PROTECT YOU: Older versions of pip can STILL trust compromised certificates even after system updates.
→ EMERGENCY UPDATES: Python developers are being told to immediately update pip, certifi, uv and other affected tools.
→ DOCKER USERS AT RISK: Existing container images may retain vulnerable certificate stores and need rebuilding.
First PHP. Then Node.js. Then GitLab. Then LiteLLM.
NOW PYTHON.
The very systems developers rely on to establish TRUST online are becoming the attack surface.
If you use Python, PATCH NOW.
"This eMudhra / emSign certificate issue + LLMs being used as an attack vector == Feeding frenzy for bad actors.
The SNAFU will be televised."
pystar retweeted
In response to the eMudhra / emSign certificate security incident we've published guidance for Python users to update CA certificates: discuss.python.org/t/informa…
#security #Python #pki
discuss.python.org/t/informa…
🔊🔊🔊
🚨🚨🚨 ALERTE SÉCURITÉ MAXIMALE ! Python est compromis.
🔸 Mettez immédiatement pip à la version 26.2.2 ou plus.
🔸 Dans chaque projet Python (chaque venv) : python -m pip install --upgrade pip
🔸 uv : uv self update (0.13.4 ou plus)
🔸 Mettez aussi à jour les certificats du système (apt / dnf upgrade ca-certificates) et vos images Docker
pip install est compromis.
L'autorité indienne eMudhra (emSign), qui signe les « passeports » prouvant qu'un site est bien celui qu'il prétend être, utilisait des clés secrètes ridiculement faibles : 8 clés, toutes inférieures à 256. L'une valait 4. Autrement dit, n'importe qui peut fabriquer un faux passeport valide pour n'importe quel site.
Le risque pour Python : quelqu'un sur ton réseau (wifi public, FAI, État) se fait passer pour pypi.org, et ton « pip install » télécharge un paquet piégé sans aucune alerte. Aucune attaque n'a été signalée pour l'instant, mais c'est trivial à faire.
Un paquet piégé peut installer n'importe quoi. Porte dérobée, virus, vol d'informations en tout genre.
La situation est terrifiante !
Rien que dans l'écosystème Python, chaque installation de CPython, chaque venv, uv, tout est exposé.
Et je ne vous parle même pas de npm, pnpm, yarn, Go, Rust.
Ma stratégie de sécurité 2026 : rester chez moi et ne me connecter à Internet que depuis un FAI de confiance.
C'est quand il y a de la mer qu'on reconnaît les vrais marins...
Readers added context they thought people might want to know
Ce n'est pas un bug Python mais une vulnérabilité des clés privées faibles des certificats intermédiaires eMudhra/emSign (d<256 dont une valant 4), exposant les bundles certifi/pip à des MITM TLS potentiels jusqu'aux mises à jour.
discuss.python.org/t/information-…
emudhra.we-have-a-problem.com
scotthelme.co.uk/eight-bits-of-…
github.com/advisories/GHS…
😨⚠️☢️🙀⚡😧🚨☣️☠️
I read this and I'm terrified, the situation seems intractable.
In the python ecosystem alone every cpython install, venv, UV is at risk.
Don't get my started on npm, pnpm, yarn, go, rust.
My current 2026 security posture: stay home and only connect to the internet from a trusted ISP.
The winter is coming.
discuss.python.org/t/informa…
pystar retweeted
webmcpisnotmcp.com good one! 😁
Courtesy of @nartmadi !
pystar retweeted
Python 3.15 adds lazy imports with the new lazy keyword! 🐍
Instead of loading a module when your script starts, Python waits until you actually use it.
Here's a quick example:
lazy import json
lazy from pathlib import Path
Good use cases:
- CLI tools where most commands only need a few modules
- Big libraries like pandas or numpy that you only use in one code path
- Apps where startup time matters
The result is faster startup times with almost no code changes.
Will you use it? 🚀
pystar retweeted
Ever wondered what actually happens on the stack and the heap? 🤔
In Python, you can get pretty far without thinking much about it.
In Rust, you can't. Ownership, borrowing, and lifetimes force you to understand where your data lives and who can access it.
The interesting part? That knowledge will make you a better #Python programmer. 💡
We wrote about this in the latest Scripter to Rust newsletter.
Subscribe to follow along as we explore #Rust from a Pythonista's perspective 👇
scripter-to-rust.kit.com/pos…
pystar retweeted
After months of work, I released version 2.5.1 of @turbogearsorg turbogears.org #python #web
New version has significant additions for agentic engineering: tools, skills etc for agents developing TurboGears app
And a new quickstart-api template for openapi servers
pystar retweeted
Python 3.15 is officially out! 🐍🚀 Here are some of the new features I'm most excited to try:
1. Lazy imports with the new lazy keyword for faster startup times
2. frozendict is now a built-in type
3. A new sentinel built-in type
4. Unpacking in comprehensions
5. UTF-8 is now the default encoding
6. Tachyon, a new sampling profiler in the profiling package
7. A faster experimental JIT compiler
8. Better error messages and more color in the CLI
Which one will you use first?
