Python 3.15.1, 3.14.9 and 3.13.17 ship pip 26.2.2

The Python release team shipped Python 3.15.1, 3.14.9 and 3.13.17 on October 21, 2026, to stop pip from trusting eMudhra. That certificate authority's keys were exposed this week. The new installers fix fresh setups, but every existing virtual environment still needs its own upgrade.

What the three releases change

All three bundle pip 26.2.2, according to the Python Insider post by Hugo van Kemenade of the release team. That pip carries certifi 2026.10.19, the list of trusted certificate authorities that no longer includes eMudhra.

Release	Type	What it bundles
3.15.1	Expedited security release	pip 26.2.2, certifi 2026.10.19
3.14.9	Expedited security release	pip 26.2.2, certifi 2026.10.19
3.13.17	Special security release	pip 26.2.2, certifi 2026.10.19

Python 3.13 normally gets no pip update in a security release, to avoid breaking older setups. Van Kemenade explains the exception: "since 3.13 only just entered security-only mode, doing a special release with installers seemed prudent."

The incident behind it is covered in eMudhra CA keys compromised: Go, Firefox, NSS ship fixes. In short, eight eMudhra intermediate keys were weak enough to guess. Anyone holding them could forge HTTPS certificates for any site.

Why a system update is not enough

Pip does not rely on your operating system alone to decide which sites to trust. Linux Compatible explains that pip always loads certifi next to the system trust store. There is no supported switch to turn certifi off. So an OS update that drops eMudhra leaves an old pip still trusting it.

That is why the Python post asks users to act inside each environment: "For all existing virtual environments on your system, please upgrade pip and uv to the latest versions." Uv is a Python package manager that can stand in for pip.

Linux Compatible adds a few details:

• uv has an escape hatch. Setting UV_SYSTEM_CERTS=true makes uv use the host's trust store. Pip has no equivalent.
• Containers need rebuilding. Images that pin an old pip keep trusting eMudhra until they are rebuilt.
• A deeper fix is proposed, not shipped. Python core contributor Tiran filed a ticket asking the ssl module to block known-bad intermediate keys. "The 'security incident' is a bad private key," Tiran wrote.

What else is in Python 3.15.1

Python 3.15.1 is also the first bugfix release since 3.15.0 shipped on October 9. Linux Compatible counts roughly 330 bug fixes from 117 contributors. The Python changelog lists three security entries:

• The bundled pip in ensurepip moves to 26.2.2.
• On Windows, mimetypes stops reading mimetypes.knownfiles by default and uses only the registry.
• The bundled libexpat XML parser moves to 2.9.0.

On macOS, Ctrl-C raises KeyboardInterrupt again in programs that create a Tk window. The macOS installers also carry a pre-release Tk that fixes "a possible hang on macOS 27.0" in tkinter apps such as IDLE. And multiprocessing now falls back to the "spawn" start method when no writable temporary folder exists.

What this means for developers

Treat this as an environment chore, not an interpreter upgrade.

• Upgrade pip in every virtual environment. The Python post gives a pinned command that installs pip 26.2.2 by URL with a checksum. Upgrade uv as well.
• Fix python.org installs on macOS. These carry their own certifi. Run pip install --upgrade certifi with each version's own Python, as the post shows for 3.15, 3.14 and 3.13.
• Rebuild images and CI caches. A Docker image or cached virtual environment built last week still has the old certifi.
• Watch Windows MIME handling. If your code reads mimetypes.knownfiles, test 3.15.1 before rolling it out.

If you skipped 3.15.0, the main changes are in Python 3.15.0 ships with lazy imports and frozendict.