# Python issues expedited security releases blocking compromised eMudhra CA certificates

> **Key takeaway:** Five Python branches received emergency updates to blacklist compromised eMudhra intermediate CA keys in the ssl module, with binary installers available only for the two newest supported versions.

**Published:** 2026-10-26T14:16:55+00:00 
**Source:** Adafruit Electronics 
**Category:** open-hardware 
**Canonical URL:** https://fosswire.org/news/python-issues-expedited-security-releases-blocking-compromis.html 

## Summary
The Python release team, led by Hugo van Kemenade, has issued expedited security releases across all maintained Python branches: 3.15.2, 3.14.10, 3.13.18, 3.12.16, and 3.11.18. These updates specifically address the compromise of eMudhra intermediate certificate authority keys by adding them to the ssl module's blocklist as a defensive measure. Binary installers are provided for Python 3.15.2 and 3.14.10, while the older three branches receive source-only security releases that administrators must compile and deploy themselves.

The releases are designed to protect Python's TLS certificate validation even before users can update pip or other tooling. The release team emphasized that standard pip operations, including self-upgrades, remain safe from attacks leveraging the compromised keys regardless of pip's own update status. All users running affected Python versions are advised to upgrade promptly.

## Certificate authority blocklist and release mechanics
- **ssl module hardening:** The core change adds the compromised eMudhra intermediate CA keys to Python's internal blocklist within the ssl module, preventing their acceptance during TLS certificate chain validation.
- **Binary vs. source release split:** Only Python 3.15.2 and 3.14.10 receive pre-built binary installers; Python 3.13.18, 3.12.16, and 3.11.18 are distributed as source-only releases requiring manual compilation.
- **Pip safety guarantee:** The release team confirmed that normal pip usage patterns, including pip self-upgrades, do not expose users to attacks based on the compromised eMudhra keys even without an immediate pip update.
- **Cross-version coordination:** All five maintained branches were updated simultaneously, reflecting the severity classification and the release team's expedited response timeline for certificate authority compromises.

## Why it matters
Linux distributions and embedded systems shipping long-term Python 3.11 through 3.13 builds will need to apply source patches or await downstream packaging, creating a window of exposure for systems without automated security updates. For open hardware and IoT platforms relying on CPython for firmware tooling or runtime scripting, the source-only nature of older branch releases imposes build infrastructure requirements that may delay deployment on resource-constrained targets.