Python security releases ship new pip to drop emSign trust

Python security releases ship new pip to drop emSign trust

21 October 2026: The Python release team has put out expedited security releases 3.15.1 and 3.14.9 and a special security release of 3.13.17, all bundling pip 26.2.2, which carries certifi 2026.10.19 to deal with the eMudhra and emSign certificate authority incident. Installing the new Python does not touch existing virtual environments, so each one still trusts the old bundle until its pip is upgraded.

Not yet independently verified. The Python release team does not give a CVE or advisory number for this release, and we have not read the Discourse announcement it links to. We will update this when it can be confirmed, and remove this note.

Why a security release changed pip

Python's security-only branches normally leave pip alone for compatibility reasons. The team made an exception because 3.13 has only just entered security-only mode, and because pip vendors its own copy of certifi, the bundle of root certificates that pip and many Python HTTP clients use instead of the operating system's store. Updating the system trust store alone therefore does not remove emSign trust from Python tooling, which is the point iThome stresses in its write-up.

3.15.1 is also the first maintenance release of the 3.15 line. Its macOS installer is built with a pre-release of Tk to fix a possible hang in tkinter applications such as IDLE on macOS 27.0.

Fixed releases

Branch	Release	Bundled pip	Bundled certifi
3.15	3.15.1	26.2.2	2026.10.19
3.14	3.14.9	26.2.2	2026.10.19
3.13	3.13.17	26.2.2	2026.10.19

The step most teams will miss

The release team asks users to upgrade pip and uv in every existing virtual environment. For pip it publishes a pinned command that installs pip 26.2.2 from its exact PyPI file with a SHA-256 hash, so the upgrade cannot be redirected to a different wheel even if the machine's trust in the index is in doubt:

• inside a virtual environment: python -m pip install "pip @ <pinned pip-26.2.2 wheel URL with sha256>", using the full URL given on the release page;
• for the macOS framework builds of 3.13, 3.14 and 3.15, the same command run with that version's interpreter, followed by pip install --upgrade certifi, which refreshes the separate certifi package many applications import directly.

Container images and CI runners deserve the same check. A base image built last week carries the old pip in its system Python and in any virtual environment baked into it, and those images are typically rebuilt only when something else changes. Requests, httpx and other clients that read certifi will keep trusting emSign until the certifi package in that environment is updated, whatever version of Python sits underneath.

Where this fits

Go and Docker Desktop have already shipped releases that drop trust in the eMudhra and emSign intermediates. For Python shops the practical test is simple: run pip --version and pip show certifi in each environment that makes outbound TLS calls, and treat anything older than pip 26.2.2 or certifi 2026.10.19 as still trusting the compromised authority.

Sources

• Python Insider: Python 3.15.1, 3.14.9 and 3.13.17 are out, 21 October 2026
• Python.org: Python 3.15.1, 21 October 2026
• iThome: Python security releases address eMudhra certificate incident, 23 October 2026