Loading story…
The Python Software Foundation advisory database published two new records, PSF-2026-14 and PSF-2026-15, in its python_advisories feed. Both entries were exposed as raw JSON files in the PSF advisory repository, but the available reference data did not include a published date, affected package name, vulnerability type, severity, or a synopsis describing the underlying issue.
The additions indicate newly tracked Python ecosystem security advisories, but the public metadata currently visible in the referenced records is limited to the advisory identifiers themselves. Security teams monitoring Python package risk should watch for follow-up details in the PSF advisory database to determine affected components, exposure, and any required remediation once the records are populated.
See the reporting duties and controls this puts on the clock.
1 event from the most recent confirmed update back to the earliest known activity.
Initial story creation
See what this changes for your reporting obligations and which controls it puts on the clock.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The Python Software Foundation disclosed a **critical authentication bypass** in the `python.org` release management API that could have let attackers forge administrator-level requests and modify Python release metadata. The flaw, reported by Splitline Ng of DEVCORE and confirmed by the Python Security Response Team, could have enabled changes to download and verification URLs for official Python installers, creating a path to distribute tampered files through trusted `python.org` infrastructure. The vulnerable logic reportedly dated back to 2014, affecting the release pipeline for more than a decade, but maintainers said post-incident forensics found **no evidence of exploitation**. The PSF patched the issue rapidly, with production fixes deployed within 24 hours and broader remediation completed within 48 hours, while also disabling risky API behavior and tightening release controls. Additional hardening included stricter URL validation, mandatory HTTPS enforcement, negative authentication test coverage, longer log retention, and stronger provenance measures around release artifacts, including emphasis on **Sigstore** alongside existing **PGP** signing. A subsequent Trail of Bits review funded by OpenAI reportedly found no additional authentication or authorization flaws, and the Foundation said the changes were designed to reduce the risk of unauthorized modification of Python downloads distributed via official channels.
Jul 12, 2026
Anthropic committed **$1.5 million** to the **Python Software Foundation (PSF)** under a **two-year partnership** to accelerate security work across the Python ecosystem, with a particular focus on reducing **software supply-chain risk** affecting the **Python Package Index (PyPI)** and the broader user base. The funding is intended to advance the PSF’s security roadmap and strengthen defenses against malicious packages and other ecosystem-level threats that can impact millions of developers and downstream organizations. Planned work includes building **automated tooling to review every package uploaded to PyPI**, shifting detection from largely report-driven, after-the-fact responses toward proactive screening, and creating a **dataset of known malware** to support capability analysis and tool development. The effort builds on PSF’s ongoing security initiatives led by **Security Developer in Residence Seth Larson** and supported by **PyPI Safety and Security Engineer Mike Fiedler**, and is positioned as potentially reusable for other open-source package repositories beyond Python.
Jun 29, 2026
Microsoft added Security Update Guide entries for **`CVE-2025-48815`** and **`CVE-2025-48818`**, with the latter explicitly associated with **PowerShell** and both listed under Microsoft’s vulnerability disclosure and update ecosystem. The entries identify Microsoft as the assigning CNA and link to standard resources including **CVSS guidance**, **CSAF/API feeds**, acknowledgements, and support lifecycle information, confirming the CVEs have been reserved and published in Microsoft’s advisory infrastructure. The available records provide almost no technical detail: they do not specify affected products or versions, severity, exploitation status, impact, or remediation steps. A related Microsoft advisory reference for **`CVE-2022-34718`** is also present but similarly lacks usable synopsis data in the provided material, leaving defenders with confirmation of the identifiers but little actionable information from the exposed entries alone.
Jun 29, 2026