PSA: If your program does HTTP requests, update your dependencies now

Here's a pile of links with info:

• https://emudhra.we-have-a-problem.com/
• https://arstechnica.com/security/2026/10/the-internet-goes-on-high-alert-after-discovery-of-8-compromised-tls-certs/
• https://www.theregister.com/security/2026/10/20/indian-certification-authority-emudhras-private-keys-compromised-one-of-them-was-the-number-4/5304312
• https://bugzilla.mozilla.org/show_bug.cgi?id=2083449

You need to update therustls-webpki crate to version 0.103.16, and thewebpki-rootsand webpki-root-certscrates to version 1.0.10. Notably, the reqwests crate depends on these crates.

If you're on a MacOS, you also need to do some manual steps to make thecurlcommand secure. I'm not quite sure if all the linux distros have patches yet, and so you might need to do stuff too.

If you don't do these, then anyone could MITM your HTTPS connection that you make to anyone, since some certificate authority used the number "4" as their entire secret key.