Python’s release team announced five expedited security releases that block compromised eMudhra certificate-authority keys in the standard ssl module. The October 26 announcement says normal pip operations gain this protection even before pip itself is updated.
This adds Python-specific remediation to the certificate incident already covered for Bun. Updating either runtime leaves the other one’s applications unchanged.
The risk follows the trust bundle
A certificate authority vouches for a server’s identity during TLS, the protocol securing network connections. Compromised authority keys can let an attacker present a forged certificate that an outdated client still accepts.
Exposure requires a client that accepts the compromised chain and an attacker able to intercept or redirect its connection. Python’s ecosystem notice warns that package downloads, including connections to PyPI, can be affected.
Updating operating-system certificates alone can leave bundled trust stores behind. Python packages, package managers, virtual environments and container layers may retain separate copies. Christian Heimes’s CPython issue explains why maintainers added a runtime-level backstop while those updates propagate.
Evidence status: maintainer-confirmed compromised keys and released defensive fixes. The reviewed Python sources provide no confirmed count of intercepted downloads or compromised Python installations.
Install the replacement for your Python line
The release announcement identifies these versions as carrying the key-blocking fix, CVE-2026-115557:
| Python line | Expedited release | Upstream distribution |
|---|---|---|
| 3.15 | 3.15.2 | Binary installers and source |
| 3.14 | 3.14.10 | Binary installers and source |
| 3.13 | 3.13.18 | Source-only security release |
| 3.12 | 3.12.16 | Source-only security release |
| 3.11 | 3.11.18 | Source-only security release |
Use your distributor’s security guidance when it backports fixes without adopting these upstream version numbers. For the source-only lines, obtain a trusted distributor’s patched build or build from the official source. Python’s notice says 3.10 and older are end-of-life and receive no further upstream security fixes.
The patch documentation describes matching the certificate’s SubjectPublicKeyInfo, its encoded public-key identity. That also blocks cross-signed certificates reusing a compromised key, rather than matching just one certificate’s fingerprint.
Refresh the copies around the interpreter
Python’s ecosystem notice calls for updating package tools and certificate bundles alongside the runtime:
- Update existing virtual environments. Refresh pip and uv inside each one. A new global installation does not replace those copies.
- Check bundled certificate stores. The notice lists pip 26.2.2, uv 0.13.4 and certifi 2026.10.19 as minimum targets. Use current compatible releases carrying these fixes.
- Rebuild container images without reusing stale layers. The notice explicitly recommends disabling layer caching so current system certificates are fetched. Redeploy the rebuilt images.
- Follow the notice’s secure bootstrap instructions for an old pip. Its upgrade path uses a pinned wheel with an integrity hash. Avoid improvising around certificate errors by disabling verification.
Certifi’s advisory identifies 2026.10.18 as its initial repair. Python recommends 2026.10.19 for compatibility with unaffected emSign roots. Those are different milestones, not conflicting instructions.
The same notice supplies separate targets for conda, pixi, sigstore and virtualenv. Check those when they are part of your build or signing workflow.
Caveat: Python’s denylist is a last line of defense for specific compromised keys, not a general certificate-revocation service. Keep operating-system trust stores and bundled copies current too.