Python's five security releases block compromised certificate keys

The Python team shipped expedited security updates for versions 3.11 through 3.15 after eMudhra intermediate certificate keys were compromised. The releases make Python's SSL module distrust those keys and also fix unsafe links in tarfile filtering and malformed cookies. Python 3.15.2 and 3.14.10 have installers; the three older branches are source-only releases.

Python Insider · Oct 26, 2026

Why it matters

If you maintain Python deployments, check which branch you run and apply the matching security release.

More context

The certificate change blocks attacks using the compromised keys even when pip itself has not yet been upgraded. The same release also prevents tarfile links from replacing the extraction destination. Check the official release notes for the exact branch and deployment method before scheduling the update.

Keep in mind

This is a security update, not a general feature release. Python 3.13.18, 3.12.16 and 3.11.18 require source-based installation rather than binary installers.

Original read