Python security releases ship new pip to drop emSign trust

Python security releases ship new pip to drop emSign trust

21 October 2026: The Python release team has put out expedited security releases 3.15.1 and 3.14.9 and a special security release of 3.13.17, all bundling pip 26.2.2, which carries certifi 2026.10.19 to deal with the eMudhra and emSign certificate authority incident. Installing the new Python does not touch existing virtual environments, so each one still trusts the old bundle until its pip is upgraded.

Not yet independently verified. The Python release team's announcement confirms the pip 26.2.2 and certifi 2026.10.19 update for the emSign incident and gives no CVE or advisory number. We have not seen a separate advisory. We will update this when it can be confirmed, and remove this note.

Update, 10 November 2026: The release announcement on the Python Discourse calls 3.15.1 and 3.14.9 expedited security releases and 3.13.17 a special security release. It says all three upgrade bundled pip to 26.2.2 with certifi 2026.10.19 for the eMudhra and emSign CA certificate security incident, and it links an information page for Python users. It gives no CVE number. Python Insider lists the releases under the heading "Five expedited security releases to distrust the compromised eMudhra intermediate CA keys".

Why a security release changed pip

Python's security-only branches normally leave pip alone for compatibility reasons. The team made an exception because 3.13 has only just entered security-only mode, and because pip vendors its own copy of certifi, the bundle of root certificates that pip and many Python HTTP clients use instead of the operating system's store. Updating the system trust store alone therefore does not remove emSign trust from Python tooling, which is the point iThome stresses in its write-up.

3.15.1 is also the first maintenance release of the 3.15 line. Its macOS installer is built with a pre-release of Tk to fix a possible hang in tkinter applications such as IDLE on macOS 27.0.

Fixed releases

Branch	Release	Bundled pip	Bundled certifi
3.15	3.15.1	26.2.2	2026.10.19
3.14	3.14.9	26.2.2	2026.10.19
3.13	3.13.17	26.2.2	2026.10.19

The step most teams will miss

The release team asks users to upgrade pip and uv in every existing virtual environment. For pip it publishes a pinned command that installs pip 26.2.2 from its exact PyPI file with a SHA-256 hash, so the upgrade cannot be redirected to a different wheel even if the machine's trust in the index is in doubt:

• inside a virtual environment: python -m pip install "pip @ <pinned pip-26.2.2 wheel URL with sha256>", using the full URL given on the release page;
• for the macOS framework builds of 3.13, 3.14 and 3.15, the same command run with that version's interpreter, followed by pip install --upgrade certifi, which refreshes the separate certifi package many applications import directly.

Container images and CI runners deserve the same check. A base image built last week carries the old pip in its system Python and in any virtual environment baked into it, and those images are typically rebuilt only when something else changes. Requests, httpx and other clients that read certifi will keep trusting emSign until the certifi package in that environment is updated, whatever version of Python sits underneath.

Where this fits

Go and Docker Desktop have already shipped releases that drop trust in the eMudhra and emSign intermediates. For Python shops the practical test is simple: run pip --version and pip show certifi in each environment that makes outbound TLS calls, and treat anything older than pip 26.2.2 or certifi 2026.10.19 as still trusting the compromised authority.

Sources

• Python Insider: Python 3.15.1, 3.14.9 and 3.13.17 are out, 21 October 2026
• Python.org: Python 3.15.1, 21 October 2026
• iThome: Python security releases address eMudhra certificate incident, 23 October 2026
• Python Discourse: Python 3.15.1, 3.14.9 and 3.13.17 are out, October 2026
• Python Insider (blog index, read 10 November 2026), 10 November 2026