* SECURITY UPDATE: TLS chains issued under a set of compromised eMudhra intermediate CA keys were still accepted. The private keys of eight eMudhra intermediate CAs leaked, so anyone holding them can mint a certificate for any name; such a chain keeps verifying for as long as the issuing roots remain in the platform trust store, which is exactly the window between the compromise becoming known and the root-store update reaching an OS, a container image, or a trust store bundled inside a Python package. - debian/patches/CVE-2026-115557.patch: backport of cpython gh-160040 / GH-160042, which adds Modules/_ssl/distrusted_spki.h, a hardcoded table of the SHA-256 digests of the eight compromised SubjectPublicKeyInfo structures, and enforces it from a new _ssl verify callback: any certificate in the chain whose SPKI digest is on the list fails verification with X509_V_ERR_CERT_REJECTED. The denylist matches the public key rather than a certificate fingerprint, so cross-signed certificates that reuse one of those keys are covered too. Upstream released the fix only in 3.11.18, 3.12.16, 3.13.18, 3.14.10 and 3.15.2, so it has to be carried for 3.8. The header and both new C functions are upstream verbatim. Upstream's one-line SSL_CTX_set_verify() change in _set_verify_mode() is adapted to 3.8's "keep current verify cb" spelling (bpo-37428), which read the context's own callback back and re-installed it; the callback it read was always NULL, so the three lines are replaced by upstream's single call installing _ssl_verify_callback. Upstream's second wiring hunk, in newPySSLSocket(), is already present in 3.8 as that same idiom and needed no change. Upstream's Makefile.pre.in hunk has no counterpart in 3.8, which builds _ssl from setup.py, so the new header is added to that extension's depends list instead. The upstream tests, the distrusted.zip fixture, make_ssl_certs.py, the Misc/NEWS.d fragment and the PCbuild project files are omitted. - CVE-2026-115557