1. Python: compromised certificate trust and archive extraction (Critical)

CVE-2026-115557 (9.4), CVE-2026-114583 (6.9)

Impact

Python announced expedited releases on 26 October. The SSL module now rejects known compromised eMudhra intermediate certificates. A separate fix prevents crafted archive links from bypassing tarfile.tar_filter and redirecting extracted files outside the intended directory. Potential impact depends on the service’s TLS connections and archive-processing behaviour; the extraction issue is limited by the extracting process’s permissions.

Checks and IoCs

Inventory the interpreter used by each service, scheduled job and container. This read-only command reports the interpreter in the current environment, not every running application:

python3 --version

Review retained TLS telemetry for connections involving the compromised certificate chain and archive-processing records for unexpected writes outside extraction directories. These are investigation leads, not proof of compromise. The release notice does not establish active exploitation of the archive flaw or supply campaign-specific IPs and hashes.

Remediation

• Deploy Python 3.15.2, 3.14.10, 3.13.18, 3.12.16 or 3.11.18, according to your supported branch, or a distribution package confirmed to contain the equivalent fixes.
• Python provides binary installers for the first two; the other three are source-only security releases. Use your operating-system or application vendor’s supported update route where applicable.
• Rebuild affected container images and restart services through your normal deployment process so the corrected interpreter is actually in use. Installing a new binary alone does not update an already running process.

Sources: Python’s 26 October release announcement · Certificate-trust CVE record · Archive-extraction CVE record