Python's security team published a warning on 22 October 2026 about certificates used by some Python tools. Cwebhook runs on Python, so we checked our systems the same day and applied the recommended update. You do not need to change anything.

What happened

A certificate authority named eMudhra had eight intermediate certificates, under a root called emSign ECC Root CA - G3, whose private keys were too weak to trust. Those certificates have been revoked. Older copies of the Python package certifi, which many tools use to decide which HTTPS sites to trust, still included that root. So did older copies of pip, Python's package installer.

Someone who could intercept a connection could present a fake certificate for a real site, and a program that still trusted that root could accept it. That includes package downloads and other HTTPS calls made with the old certificate bundle. It does not mean Python itself was broken into, and it does not mean someone got into Cwebhook.

What we did

Cwebhook's customer portal, TradingView webhook, and live and demo trading workers use this certificate bundle for their HTTPS requests.

We installed the versions the Python project asked for: certifi 2026.10.19 and pip 26.2.2. We then checked the certificate files those services use and confirmed the compromised emSign root is no longer there. The portal, webhook, and both workers were restarted and came back online normally, including the connections they use for trading and notifications.

The server operating system certificate store did not include that compromised root. We also locked our Python dependencies to the patched certificate bundle so an older copy cannot be installed later.

What this means for you

This was a certificate-trust update. It was not a breach of Cwebhook customer accounts, webhook URLs, or cTrader connections. You do not need to reset your password, reconnect your broker, or change your TradingView alert.

If you use Python on your own computer, update certifi to 2026.10.19 or later and pip to 26.2.2 or later. Python's notice is here:

https://discuss.python.org/t/information-for-python-users-regarding-emudhra-emsign-ca-certificate-security-incident/109576

Questions about your Cwebhook account: https://cwebhook.com/support