Python is for everyone: Join in the PSF year-end fundraiser & membership drive!

The Python Software Foundation (PSF) is the charitable organization behind Python, dedicated to advancing, supporting, and protecting the Python programming language and the community that sustains it. That mission is more than words to us; it’s the community we show up for every day. Our tiny but mighty team works hard to deliver the projects, services, and programs that allow Python to be the thriving, independent, community-driven language it is today. Some of what the PSF does includes producing PyCon US, hosting the Python Package Index (PyPI), supporting Developers in Residence, maintaining critical community infrastructure, and more.

Python is for gathering, teaching, learning, playing, researching, exploring, creating, building, working, sustaining. The list goes on and on and on! Support this year’s fundraiser with your donations and memberships to help the PSF, the Python community, and the language stay strong and sustainable. Because Python is for everyone, thanks to you. 

 

There are two direct ways to join through donate.python.org: 

• Donate directly to the PSF! Your donation is a direct way to support and power the future of the Python programming language and community you love. Every donation makes a difference, and we work hard to make a little go a long way.
• Become a PSF Supporting Member! When you sign up as a Supporting Member of the PSF, you become a part of the PSF, are eligible to vote in PSF elections, and help us sustain our mission with your annual support. You can sign up as a Supporting Member at the usual annual rate ($99 USD), or you can take advantage of our sliding scale option (starting at $25 USD)! 

>>> Donate or Become a Member Today! <<<

 

  

If you already donated and/or you’re already a member, you can:

• Share the fundraiser with your regional and project-based communities: Share this blog post in your Python-related Discords, Slacks, social media accounts- wherever your Python community is! Keep an eye on our social media accounts to see the latest stories and news for the campaign.
• Share your Python story with a call to action: We invite you to share your personal Python, PyCon, or PSF story. What impact has it made in your life, in your community, in your career? Share your story in a blog post or on your social media platform of choice and add a link to donate.python.org.
• Ask your employer to sponsor: If your company is using Python to build its products and services, check to see if they already sponsor the PSF on our Sponsors page. If not, reach out to your organization's internal decision-makers and impress on them just how important it is for us to power the future of Python together, and send them our sponsor prospectus.

 

Your donations and support:

• Keep Python thriving 
• Support CPython and PyPI progress 
• Increase security across the Python ecosystem 
• Bring the global Python community together 
• Make our community more diverse and robust every year

 

PSF highlights from 2026:

• Producing another wonderful PyCon US: We welcomed 1,901 attendees to PyCon US 2026, 1,064 of whom were newcomers, at the Long Beach Convention & Entertainment Center in beautiful downtown Long Beach, CA, our first year in the city! PyCon US 2026 was packed with 7 days of content, education, and networking for the Python community, including 6 Keynote Sessions, 90 Talks (including the Charlas Spanish track and the new Future of AI with Python and Trailblazing Python Security tracks), 20 Tutorials, 25 Posters, 25+ Sprint Projects, 123 Open Spaces, 62 Booths, and 83 Sponsors!
• Powering the inaugural Python Packaging Council election: We were excited to run the election that formed the first Python Packaging Council (PPC)—a long awaited technical decision-making body! The PPC will work to develop interoperability specifications that govern how Python packages are built, distributed, and installed. It will also coordinate efforts among packaging tool maintainers, the Python core team, and the broader community. The PSF is proud to have provided the administrative, logistical, and communications support that got the new council up and running.
• Safeguarding PyPI against emerging threats: PyPI completed its second external security audit, carried out by Trail of Bits and funded by the Sovereign Tech Agency. The review turned up fourteen findings, two of them high severity, and PSF PyPI Safety and Security Engineer Mike Fiedler has already fixed all but two low-risk items that need larger changes. The auditors also wrote custom CodeQL queries, now part of PyPI’s automated checks, so the next bug of the same kind gets caught before it ships. Additionally, PyPI now rejects new files on releases older than 14 days, which stops anyone from grafting a malicious wheel onto a version people already trust. Meanwhile, community reporters sent in just under 1,000 malware and abuse reports in Q1, with over 40% landing in automated quarantine, protecting the Python ecosystem faster than ever. 
• Developing and adopting the PSF’s 5 Year Strategic Plan: We’re proud to share that the PSF Board adopted the PSF Strategic Plan 2026, covering 2026 to 2031, at its July 2026 meeting! This plan took shape in the open: we shared the high-level goals in May, then published the full draft in June and invited the community to weigh in. Our new PSF Strategy page is its permanent home, where we’ll publish annual review findings and updates so the community can follow our progress. 
• Sustaining the Python Security Response Team: As the number of vulnerability reports and CVE advisories grew 3-4X, the mostly-volunteer Python Security Response Team (PSRT) grew and adapted with it. Following the approval of PEP 811, 13 new members joined the PSRT, its first additions since 2023, and PSF Security Developer-in-Residence Seth Larson published a new security policy and threat model that helps coordinators quickly tell security-relevant reports from regular bugs. The team published 15 vulnerability advisories in Q1 and triaged and fixed a python.org API authentication vulnerability in under 48 hours, followed by a third-party audit by Trail of Bits. 
• Empowering the Python community through Fiscal Sponsorship: We are proud to continue supporting our 20 fiscal sponsoree organizations with their initiatives and events all year round. The PSF provides 501(c)(3) tax-exempt status to fiscal sponsorees such as PyLadies and Pallets, and provides back office support so they can focus on their missions. Consider donating to your favorite PSF Fiscal Sponsoree and check out our Fiscal Sponsorees page to learn more about what each of these awesome organizations is all about!
• Introducing the new PSF Community Partner Program: The PSF announced the introduction of the PSF Community Partner Program in 2026. This new program is designed as an “in-kind” way for us to support Python events and initiatives with non-financial assistance through the use of the PSF logo and name, as well as promotional support via sharing qualified posts on PSF official social media accounts. The PSF has welcomed almost 40 community events and initiatives to the program so far! 
• Serving our community with grants: We brought back the PSF Grants Program in a restructured and more sustainable format after a pause in 2025. The PSF awarded approximately $60K over 44 grants awards across the world in 2026; supporting local conferences and workshops that keep Python growing and accessible to all. We also opened up applications for the PSF's Meetup Pro Network. We hope to continue grant funding rounds in the future and your participation in this year’s fundraiser fuels that effort!
• Honoring community leaders: We honored 10 PSF Community Service Award (CSA) recipients this year across two batches. Abhijeet Mote, Elena Williams, Inessa Pawson, Kafui Alordo, Kalyan Prasad, Hugo van Kemenade, Kevin Horn, Maria Jose Molina Contreras, Paul Everitt, and Sarah Abderemane received CSAs in 2026 for their dedication, creativity, and generosity that help the PSF fulfill its mission to support and facilitate the growth of a diverse and international community of Python programmers.

How the Python ecosystem responded to the eMudhra intermediate compromise

The news of the eMudhra Intermediate CA compromise was published on October 20th, 2026. Responding to an incident like a Certificate Authority (CA) compromise at an ecosystem-scale is far from “routine”; the assumption that HTTPS is secure is baked into many aspects of Python applications and packaging. This meant it was critical to mount a response that was both comprehensive and customized to each affected project and service, ranging from the Python language, pip, and the Python Package Index (PyPI).

This is where security staffing at the Python Software Foundation made a difference for Python. Staffing meant that Seth Larson, the Security Developer-in-Residence, was on standby able to respond and begin work on the issue immediately. Pre-existing relationships with affected project maintainers afforded plenty of trust, and the work was completed in a way that respected the time of volunteer maintainers for affected packages by reaching out proactively with clear next steps. Thanks to Alpha-Omega for funding the Security Developer-in-Residence position at the Python Software Foundation.

The incident was mitigated across multiple components within two days. Thanks to the work of their respective maintainers: fixes were made available for certifi, Python, pip, uv, sigstore, virtualenv, conda, pixi, manylinux, gh-action-pypi-publish, and many other projects. Vulnerable versions of certifi, pip, and sigstore were patched across all projects and services that the Python Software Foundation stewards, including PyPI, Python’s release process and build bots, and python.org. Containers have been rebuilt with the correct set of certificates.

Advisories, CVE records, banners, and discussion threads were created to alert the community about the work necessary to mitigate this incident and to be a location where relevant discussions and questions were answered by experts. Subscribe to the security-announce mailing list for future advisories about Python, pip, and other exceptional circumstances like this incident. Information about which projects are affected is available on discuss.python.org and around the web for more projects.

How did this incident affect Python as an ecosystem?

This section details the current situation of multiple Python projects. An aspect of positive security culture is “blameless post-portems”, we can only improve the future and the best way to do this is to show up and support the projects and maintainers that you depend on. Please note that all decisions below have historical context and sound reasons for being: Python is about the same age as TLS and is much older than the expectation that your system has up-to-date and secure CA certificate bundles.

The key component requiring a prompt response to the incident from the Python ecosystem is “certifi” and the advisory GHSA-6q48-6c7w-9gw2. Certifi is a repackaging of Mozilla’s CA bundle as a Python package and used by many popular projects including pip and requests. The package only includes root CAs, not intermediates, and therefore needed to remove the root CA from the CA bundle (“emSign Root TLS CA - G3”) to distrust all the impacted intermediate certificates.

Keeping a long story short: certifi is a critical dependency for being able to bootstrap a Python virtual environment into being able to install packages from PyPI. pip bundles its dependencies which includes “Requests” which depends on certifi. Python bundles pip so new virtual environments always contain pip through a mechanism called “ensurepip”.

This arrangement put all three of these components, Python, pip, and certifi, in the critical path for permanently remediating this incident as a user through software updates. There also isn’t an easy answer for older versions of Python which would permanently contain an older version of pip due to compatibility concerns. To address this concern, Python has added a “last-resort” denylist to reject the compromised intermediate certificates during a TLS handshake, fixed versions and more information tracked via CVE-2026-115557 which has been backported to older versions of Python.

What happens next?

We’re continuing our efforts to alert users through advisories and CVE and using banners on the PyPI and discuss.python.org and will be closely monitoring the uptake of patched versions of “certifi” across the ecosystem. The immediate, synchronous response has concluded, now we turn to what should be prioritized so a future incident like a CA compromise might not require as urgent a response from volunteer maintainers.

Right from the beginning of the incident it was identified that TLS handshakes made by browsers were secure, but tools like pip, git, uv weren’t secure. Why is this? Browsers were able to secure their certificate stores quickly and without requiring a software update by using Certificate Revocation Lists (CRL). CRLs allow providers of CAs to provide information to verifiers outside of the software update process, such as when certain certificates should no longer be used due to revocation or compromise.

These technologies may be integrated into Python in the future to provide a quicker and robust response to future incidents involving CA certificates and allow distributions to configure these facilities system-wide. One potential project to watch is upki, which has already been adopted by Ubuntu, provides certificate revocation functionality similar to that of browsers on platforms which previously did not offer such facilities.