Rustup updates its certificate roots after eMudhra compromise

Rustup 1.29.2 updates its rustls-webpki and webpki-root-certs dependencies to address the compromised eMudhra intermediate certificates. The Rustup team recommends updating existing installations with `rustup self update`; normal toolchain updates also refresh rustup automatically. The small release is a targeted trust-store fix rather than a broader toolchain update.

The Rust Blog · Oct 20, 2026

Why it matters

Rust developers who install toolchains with rustup should make sure the installer itself has received this certificate correction.

More context

The release notes point to CVE-2026-111943 and RUSTSEC-2026-0382. The team notes that antivirus software may temporarily block new rustup files while scanners update their release signatures.

Keep in mind

This is a focused rustup patch and does not replace the separate Python releases addressing the same certificate incident. Check the advisory and verify the rustup version on systems that manage toolchains.

Original read