Python 3.15.1, 3.14.9 and 3.13.17: Security updates released
Three Python releases published on October 21, 2026 include important fixes related to the eMudhra / emSign certificate security incident. Here is what changed, why it matters, and what developers should do next.
At a glance: The Python team released versions 3.15.1, 3.14.9 ve 3.13.17 with security-focused updates. All three bundle pip 26.2.2 , which includes the updated certifi 2026.10.19 package to address the eMudhra / emSign certificate incident. Existing virtual environments should also be checked separately.
Why did Python issue urgent security updates?
Python powers everything from web applications and data analysis to automation and backend services. Many of these projects communicate with external services over HTTPS and download dependencies from online repositories. Keeping that traffic secure depends not just on Python code but also on packages that define trusted certificate authorities .
In October 2026, a security incident involving the eMudhra / emSign certificate chain prompted the Python team to publish three releases so fixes to certificate trust data could reach users more quickly. The goal is to reduce connection-verification risks caused by outdated certificate trust lists.
These updates matter not only to developers seeking the newest Python features, but also to those who want to keep their existing applications and package-installation workflows secure .
What changed in Python 3.15.1, 3.14.9, and 3.13.17?
Although the October 21, 2026 releases address the same certificate-related issue, they target different Python series. Staying on your current series and applying the relevant security patch can be a more controlled first step than making a major-version upgrade.
3.15.1 is the first maintenance release in the Python 3.15 series. According to the official release notes, it includes approximately 330 changes covering bug fixes, build improvements, and documentation updates. 3.14.9 includes around 168 similar fixes.
3.13.17 takes a different approach: although Python 3.13 has entered its security-fixes-only phase, the importance of the certificate incident led to a special release that also includes installers.
Note: These versions were announced on October 21, 2026. Before installing, check whether a newer security patch is available for your Python series.
What is the eMudhra / emSign certificate security incident?
HTTPS connections use certificate chains to verify that a server really belongs to the domain it claims to represent. Packages such as certifi provide trusted certificate lists used by certain clients in the Python ecosystem during this verification process.
Risk of impersonation through trusted certificate chains
The compromise of private keys belonging to certain intermediate certificate authorities associated with eMudhra created a risk that fraudulent but apparently valid TLS certificates could be issued under specific conditions. If an attacker can also interfere with network traffic, this may enable man-in-the-middle (MITM) attacks. This does not mean that every Python HTTPS connection has been compromised; exposure depends on the trust store in use and the network conditions.
Certificate bundle updated
The Python security announcement recommends at least certifi 2026.10.19 . This release addresses the affected trust relationship while retaining emSign roots that were not implicated in the incident.
Package installation chain updated
pip 26.2.2 includes an updated copy of certifi, allowing pip’s own certificate-verification component to use the revised trust data.
Exceptional security release
Although the 3.13 series is in its security-fixes-only phase, the Python team made a separate release with installers for this incident.
One update does not cover every environment
Check whether your application obtains trusted certificates from the operating system, a separately installed certifi package, or a bundle embedded in another tool.
Which tools and development environments are affected?
The effects of this incident extend beyond the Python interpreter. Official Python security guidance also recommends updating package-management and verification tools.
- certifi 2026.10.19 or later: Updates the trusted certificate authority bundle; it may be used as a separate package by some HTTP clients.
- pip 26.2.2 or later: Includes updated certificate components for the Python package installer.
- uv 0.13.4 or later: Important for dependency downloads and environment setup in projects that use uv.
- sigstore 4.5.1, conda 26.9.4, pixi 0.82.1 or later: Update the corresponding package and environment management tools if you use them.
- Existing virtual environments: Previously created
venvor similar environments may not be updated automatically when the system-wide Python installation changes. - Docker and servers: Container images that retain old certificate stores in cached layers should be updated and, when necessary, rebuilt without the cache.
Python update steps for developers
Before deploying these changes to production, review the Python installations on development machines, servers, and in CI/CD pipelines separately. The steps below provide a practical general checklist.
Check the versions of Python and packaging tools
Identify the active interpreter and the pip version associated with it. Check each virtual environment individually; a system can have multiple Python installations.
# Active Python version python3 --version # pip version associated with this Python installation python3 -m pip --version # Version of separately installed certifi, if present python3 -m pip show certifi
Install the security release for your Python series
For Python 3.15, use 3.15.1; for 3.14, use 3.14.9; and for 3.13, use 3.13.17 or a newer patch within the same series. Install through the official Python installer or your system package manager, and verify compatibility with your project.
Safely update pip in existing virtual environments
Installing a newer Python version does not automatically update tools in previously created virtual environments. Activate the relevant environment first. You can use the Python team’s SHA-256-pinned pip wheel URL to perform the update.
# First activate the virtual environment you want to update # The following command is taken from the Python team announcement python -m pip install "pip @ https://files.pythonhosted.org/packages/3f/06/3e4420302363fbb71be3c7f35ce042f54bfca330e3e66b3a2e3c4cca579f/pip-26.2.2-py3-none-any.whl#sha256=fd7f4dfa8190e014013b9f08f3e973f4e4c26ffd179a204895533a7254813a70" # Once pip is updated, check certifi python -m pip install --upgrade certifi python -m pip --version
Update other tools and deployment images
If you use uv, conda, pixi, or sigstore, apply the safe version thresholds listed in the official advisory. Rebuild Docker images from updated base images and disable the layer cache when needed. Check operating-system CA packages as well.
Repeat connection, dependency, and deployment tests
Verify that PyPI access, HTTPS connections, API calls, dependency installations, and CI/CD jobs work correctly. After deployment, check the actual Python and pip versions running in production.
Common questions about Python security updates
Do I have to upgrade to Python 3.15.1, 3.14.9, or 3.13.17?
If you are using an affected release and outdated certificate components, you should not delay the security update. Apply the appropriate patch within your current Python series and run your dependency tests.
Is updating Python alone enough to update pip and certifi?
The new official Python installers include the updated pip version. However, existing virtual environments, separately installed certifi packages, and certificate lists embedded in other tools may require additional updates.
Does the certificate incident affect every HTTPS connection?
No. The risk depends on the trust store in use and conditions such as whether an attacker can interfere with network traffic. Keeping trusted certificate lists current is important nevertheless.
What if I use Python 3.12 or an older series?
Instead of moving directly to one of these three releases without testing, first check the support status of your existing Python version. Apply security fixes for pip, certifi, uv, and operating-system certificate packages as needed, and plan a migration away from unsupported releases.
Is restarting my Docker image enough?
No. Outdated certificate lists may be embedded in the image or cached build layers. You may need to rebuild with a current base image and updated packages, then test and redeploy.
Official Python announcements and security resources
This article is based on the Python core team’s October 21, 2026 announcement, the Python.org release pages, and the security advisories published for the eMudhra / emSign certificate incident.
- 01 — Python Insider — announcement of 3.15.1, 3.14.9, and 3.13.17
- 02 — Python.org — eMudhra / emSign security advisory
- 03 — Python 3.15.1 official release notes
- 04 — Python 3.14.9 official release notes
- 05 — Python 3.13.17 official release notes
- 06 — certifi security advisory — GHSA-6q48-6c7w-9gw2
- 07 — Hardcodd — technology news for developers
