#python
-
CPython's JIT compiler to be removed after PEP 836 is withdrawn
The authors of CPython's experimental JIT compiler have withdrawn PEP 836 after failing to satisfy the Python steering council. The code is likely to be removed from the main branch soon.
-
Astral Brings uv and ty Together into One Python Toolchain
Astral has shipped an experimental integration of its uv package manager and ty type checker, adding first-class PEP 723 script support and a unified uv check command.
-
A Leaked LiteLLM Master Key Turned Into a Poisoned Python Release
A master key accidentally published in May was never actually revoked — and in October an attacker used it to hijack LiteLLM's release pipeline and push a malicious version of the package.
-
Critical Pillow Flaw Turns a Filename Into Command Execution
Python's most popular image library could be made to run commands on a server simply by the name given to an EPS file it was asked to open. The fix landed in version 13.0.0.
-
Compromised LiteLLM 1.107.0 on PyPI shipped a credential stealer and backdoor
Version 1.107.0 of the popular LLM gateway LiteLLM, uploaded to PyPI, carried a credential stealer and a remote-code-execution backdoor. The GitHub source was clean, yet the malicious files ran on every Python process start on the host.
-
SAP Patches Maximum-Severity OAuth2 SSRF Flaw in Python Cloud SDK
SAP's October security release fixes 20 vulnerabilities, including a maximum-severity bug in its Python SDK that lets attackers steal application credentials.
-
Python 3.15 released
The new release of the Python language brings the sentinel and frozendict built-in types, UTF-8 encoding by default, and further work on the experimental JIT compiler.
-
When random isn't random enough: the modulo trap
The classic way to pick a random object — grab a big number and take it modulo the count — quietly breaks uniformity. The author explains why, and what to reach for instead.
-
Rust comes to CPython: zlib will be the first module
At the Python Language Summit 2026 the Rust for CPython team laid out a roadmap for gradually bringing Rust into the interpreter — starting with an optional implementation of the zlib module in Python 3.16.
-
Flaw in the Official MCP Python SDK Lets Malicious Servers Steal OAuth Credentials
A rogue MCP server could trick an app built on the official Python SDK into handing over its client secret, authorization code, and PKCE proof key. Fixes are in versions 1.30.0 and 2.2.0.
-
Can gzip be a language model?
A developer showed that the plain archiver shipping with every OS can continue text with no neural network at all — simply because compression is prediction.
-
Why you can't glue .tar.gz files together with cat
A simple task — merging several archives into one — sent a developer deep into the inner workings of tar and gzip, the history of magnetic tape, and patent wars.
-
The Neural Network That Decides Whether a Number Is Numberwang
Developer GraafHenk has posted a tiny neural network on GitHub that delivers a verdict for Numberwang, a fictional game from a British sketch show. The whole project is a 1.8 MB model file and about a hundred lines of pure Python.
-
A Python Interpreter in 1024 Bytes of Pure C
For the fun of it, Austin Henley wrote a tiny interpreter for a subset of Python in C, fitting it into exactly 1024 bytes. No macros, no library tricks.
-
Polars 2.0: streaming engine by default and the promised “boring” upgrade
The Polars developers have released the first release candidate of version 2.0. The headline change is the switch to a streaming engine by default, which promises a manyfold boost in performance.
-
How str.lower() Became a Python Vulnerability
A routine call to lowercase a string broke conformance with the IDNA 2003 standard and turned into a CVE. The culprit is the version of Unicode the interpreter works with.
-
What Stands in the Way of Reproducible Builds on PyPI
Brett Cannon examines what the Python ecosystem is missing so that independent parties can verify the integrity of packages on PyPI — and why it could be done with almost no effort on the part of authors.
-
Django moves to an annual release cycle with three years of support
The Django web framework project has adopted a proposal for an annual release cycle. Every release will be supported for three years, and the “LTS” label is becoming a thing of the past.
-
Post-Quantum Cryptography Comes to Python
The pyca/cryptography library has gained support for the post-quantum algorithms ML-KEM and ML-DSA — now they're available to the entire Python ecosystem with a single pip install command.
-
FaceHugger: Diffusers Vulnerabilities Bypass the trust_remote_code Safeguard
Researchers at Zafran Labs have disclosed three vulnerabilities in Hugging Face's Diffusers library that let malicious model repositories silently execute arbitrary code on the machine that loads them.
- More