The Python core team shipped five releases on 1 October 2026: 3.10.22, 3.11.17, 3.12.15, 3.13.16 and 3.14.8. Most of the changes are security fixes that go into every branch. For anyone running Python on servers, though, two lifecycle changes matter more. Python 3.10.22 is the last release of the 3.10 series, which is now end of life. Python 3.13 also moves from regular maintenance to security-only fixes. If your applications, cron jobs or automation scripts still rely on 3.10, now is the time to plan the move.
What was released
| Version | Status after this release | Downloads |
|---|---|---|
| 3.14.8 | Active maintenance (bug and security fixes) | Source and binary installers |
| 3.13.16 | Last regular maintenance release, security fixes only from now on | Source and binary installers |
| 3.12.15 | Security fixes only, until October 2028 | Source only |
| 3.11.17 | Security fixes only, until October 2027 | Source only |
| 3.10.22 | Final release, end of life | Source only |
The 3.13.16 and 3.14.8 releases also update the bundled OpenSSL to 3.5.9. For 3.13 this moves the official Windows, macOS and Android builds from the OpenSSL 3.0 series to the 3.5 LTS branch. If any of your tools depend on specific TLS behaviour on those platforms, test them before you roll this out.
Security fixes worth knowing about
Nine security issues were fixed in all five branches. Several of them affect modules that server code uses every day:
- tarfile: CVE-2026-19672 fixes a path traversal during extraction. CVE-2026-82049 fixes how the extraction filter handled archives containing hard links and symlinks. Branches 3.10 to 3.13 also get CVE-2026-87910, where the filter was not applied on a fallback path used to extract links.
- zipfile: CVE-2026-15310 adds decompression limits for bzip2, LZMA and Zstandard entries.
- ssl and asyncio: CVE-2026-19553 tightens checks on SSL context arguments and TLS hostnames in asyncio. CVE-2026-19445 fixes a crash when an SNI callback switches contexts.
- urllib: CVE-2026-15806 limits credentials stored in HTTPPasswordMgr to the correct URL scheme.
- Codecs: CVE-2026-17084 restricts the Unicode input accepted by the stringprep and IDNA codecs.
- The bundled libexpat moves to 2.8.5. Python 3.10.22 also adds protection against hash-flooding attacks to the expat and ElementTree XML parsers.
If your code unpacks uploaded archives, fetches URLs with stored credentials or handles TLS in asyncio, roll these releases out soon. If you use your distribution’s Python packages, apply the vendor’s updates as they arrive through dnf or apt.
What end of life means for 3.10
The Python project will not publish any more fixes for 3.10, even for serious vulnerabilities. If a flaw turns up next month in tarfile, ssl or the HTTP modules, only 3.11 and later will get the fix.
Linux servers have one important exception. If you use the python3 package that came with your distribution, your vendor decides how long it stays patched, not python.org. Ubuntu 22.04 LTS, for example, uses Python 3.10 as its system interpreter, and Canonical maintains its own package for the supported life of that release. Do not remove or replace the system Python, because the package manager and OS tools depend on it. The real risk is in interpreters you installed yourself: builds from source, pyenv installs, Docker images based on python:3.10, and virtual environments created from any of them. Applications pinned to 3.10 also need work before they can move to a newer distribution.
How to find and upgrade 3.10 workloads
1. Take inventory
# Interpreters present on the host
ls -l /usr/bin/python3* /usr/local/bin/python3* 2>/dev/null
# Interpreter version behind each virtual environment
find / -name pyvenv.cfg -not -path "/proc/*" 2>/dev/null -exec grep -H '^version' {} \;
# Container images built on 3.10
grep -rn "FROM python:3.10" --include="Dockerfile*" .2. Choose a target version
For most projects, 3.12 or 3.13 is a sensible target. Libraries support both well, and both still get security fixes, with 3.12 covered until October 2028. If your dependencies are ready, 3.14 gives you the longest support period and is the only branch that still gets regular bug fixes.
3. Install the new interpreter alongside the old one
On RHEL, Rocky Linux and AlmaLinux 9, newer Python versions are separate AppStream packages, so they install without touching the system interpreter:
sudo dnf install python3.12 python3.12-pip
python3.12 -m venv /opt/myapp/venv-312On Debian and Ubuntu, you can use the interpreter your release ships, upgrade to a newer release, or use a tool such as uv to manage Python versions per project:
uv python install 3.13
uv venv --python 3.13 /opt/myapp/venv-3134. Test and switch
- Rebuild the virtual environment from your requirements or lock file instead of copying it. A virtual environment only works with the interpreter that created it.
- Run your test suite and fix deprecation warnings. Python 3.12 removed
distutils,imp,asyncoreandasynchat, and 3.13 removed older modules such ascgi,cryptandtelnetlib. - Update systemd units, cron entries and Gunicorn or uWSGI configs that point to the old environment path.
- Keep the old environment until the new one has run in production for a while. Rolling back is then just a path change.
- Rebuild container images on a supported base tag and redeploy them.
How TechProvidence can help
Runtime upgrades often get postponed until an audit or a vulnerability forces them. TechProvidence can audit your servers and containers for unsupported interpreters, plan and test the upgrade, rebuild deployments with a clear rollback, and keep your Linux servers patched under a managed plan. If you have Python 3.10 workloads you would rather not handle yourself, contact us.
Source: Python Insider
