* SECURITY UPDATE: ssl accepted TLS certificate chains signed by the compromised eMudhra intermediate CAs. Their keys were compromised and revoked, but a chain issued by one of those intermediates keeps verifying until the platform root store (OS image, container image, or a CA bundle shipped inside a Python package) drops the issuing roots, so an attacker able to obtain such a certificate could impersonate any host to an ssl client. - debian/patches/CVE-2026-115557.patch: backport of cpython 7dd8b4736a1419750b94a388e6d158be15836fe6 (gh-160040, GH-160042). _ssl now carries the SHA-256 digests of the eight compromised intermediates' SubjectPublicKeyInfo and rejects, from an OpenSSL verify callback, any chain containing a certificate whose SPKI digest is on the list, reporting X509_V_ERR_CERT_REJECTED. Matching the public key rather than a certificate fingerprint also covers the cross-signed certificates that reuse one of those keys. Upstream shipped this in 3.11.18, 3.12.16, 3.13.18, 3.14.10 and 3.15.2 only, so 3.6 needs it carried. The denylist header is placed at Modules/_ssl_distrusted_spki.h because 3.6 has no Modules/_ssl/ directory, the callback is installed at both of 3.6's SSL_CTX_set_verify() call sites (_set_verify_mode() and set_post_handshake_auth()), and the new header is declared through setup.py, which builds the _ssl extension in 3.6. Upstream's newPySSLSocket() hunk has no counterpart: 3.6 has no SSL_set_verify() call. The upstream tests, test certificate fixture, NEWS fragment and PCbuild changes are not carried. - CVE-2026-115557