Python 3.15.2 Security Fix, PHP 8.6 Session Defaults, Java 21 in the Browser: Developer News for November 2026

The first week of November 2026 is a busy one for anyone who writes Python, PHP or Java. Python 3.15 is out and already has two security releases, a certificate authority mistake forced the whole Python packaging ecosystem to ship fixes, PHP 8.6 is two weeks away from release with safer session settings, and Java 21 now runs (and even compiles) inside a browser tab. There are also useful updates for pandas and Next.js users.

Here is a plain-English summary of each story, what it means for you as a student or working developer, and links to the official sources so you can check the details yourself.

1. Python 3.15 Is Out, and You Should Already Be on 3.15.2

Python 3.15.0 was released on October 9, 2026, with 5,643 commits from 1,012 contributors since Python 3.14, according to python.org. Headline features covered by Real Python's November news roundup include lazy imports, a built-in frozendict, a new sentinel built-in, UTF-8 as the default encoding, unpacking inside comprehensions ([*x for x in lists]) and a new low-overhead sampling profiler in the profiling package.

The release was followed quickly by two maintenance releases. As release manager Hugo van Kemenade wrote in his October recap, the Python team made 16 releases in October when only five were originally planned. Python 3.15.2 (dated October 25 on python.org) is described as an expedited security release. Its security content includes CVE-2026-115557 (blocking the compromised eMudhra certificate keys, see the next story) and CVE-2026-114583, a tarfile extraction filter fix. Matching releases came out for 3.14, 3.13, 3.12 and 3.11.

Also worth noting: Python 3.10 has reached end of life. The python.org downloads page lists 3.10.22 as its last release, so it gets no more security fixes. If your school project, server or Docker image still uses 3.10, plan the upgrade now.

2. Eight Bad Certificate Keys Sent pip, certifi and uv Scrambling

This is the story with the most practical impact. As SecurityWeek reported, the private keys of eight intermediate certificates issued by the Indian certificate authority eMudhra were generated incorrectly. Mozilla's Dennis Jackson explained that the keys were "effectively all-zeroes apart from the last byte" and could be recovered almost instantly from the public certificates. Anyone holding such a key could create a fake HTTPS certificate for any website that clients trusting that chain would accept.

Browsers moved fast: according to SecurityWeek, Mozilla and Google blocked the certificates on October 17, and Apple and Microsoft followed on October 19 and 20. eMudhra published a statement on the incident and revoked the certificates.

Why does this matter for Python? Many Python tools do not use your operating system's certificate store. As Real Python explains, requests and HTTPX use the certifi bundle, and pip ships its own copy, so updating your browser or OS does not fix them. The fixes came in layers: new certifi releases, pip 26.2.2, a uv update, and finally the ssl module in the new Python releases, which now blocks the compromised keys no matter which bundle you load.

What to do: following Real Python's checklist, upgrade Python itself (to 3.15.2, 3.14.10, 3.13.18, 3.12.16 or 3.11.18 depending on your branch), then run this in every virtual environment and container:

python -m pip install --upgrade pip certifi

If you use uv, update it too (Real Python recommends 0.13.6 or later), and rebuild Docker images without the layer cache so an old pip does not survive.

3. Python 3.16 Alpha and the Return of ?? and ?.

Python 3.16.0 alpha 1 arrived on October 13, and two new draft proposals are getting a lot of attention. PEP 824, by Marc Mueller and sponsored by Guido van Rossum, proposes the None-coalescing operators ?? and ??=. PEP 823 proposes the None-aware access operators ?. and ?[ ]. If you know JavaScript, C# or PHP, they will look familiar.

The difference from or is important. age = user_age or "unknown" also replaces 0 and empty strings, while the proposed user_age ?? "unknown" would only replace None. PEP 824 also shows users ??= [] as a cleaner way to handle mutable default arguments. Both PEPs are drafts targeting Python 3.16, so this syntax is a SyntaxError in every released Python today. The idea was first proposed more than ten years ago in PEP 505, so it is far from certain that it will be accepted this time.

4. PHP 8.6 Release Candidate 5 Is Due, With Safer Sessions by Default

According to the PHP 8.6 release schedule, the final release candidate (RC5) is planned for November 5 and general availability for November 19, 2026. The PHP 8.6.0 RC4 announcement on October 21 noted that it contains the fixes for two critical vulnerabilities that can allow unauthenticated remote code execution, and asked everyone running earlier 8.6 test builds to update. As always, release candidates are not for production.

The change most PHP developers will notice is in sessions. Following an accepted RFC, PHP 8.6 changes three defaults, as listed in the official migration guide:

• session.use_strict_mode is now 1, so PHP rejects session IDs it never issued (protection against session fixation).
• session.cookie_httponly is now 1, so JavaScript can no longer read the session cookie through document.cookie.
• session.cookie_samesite is now "Lax", so the session cookie is not sent with cross-site POST requests.

For most login systems this is free security. But if your project receives a cross-site POST that needs the session, such as a payment gateway that posts back to your site, test it on 8.6. The migration guide says such apps must set session.cookie_samesite to "None" together with session.cookie_secure = 1. Values you already set in php.ini or your code still win.

5. pandas 3.1 Adds select() and a Faster read_csv()

pandas 3.1.0 was released on October 22. The new DataFrame.select() method picks existing columns and computes new ones in one call using pd.col() expressions, and later arguments can refer to columns created by earlier ones. DataFrame.filter() gained a cond argument for filtering rows with a mask. The release notes also say read_csv() with the default C engine is considerably faster, with a single-threaded read "typically two to three times" faster than before, and large files can now be read in parallel.

If you only need to read and write simple CSV files, Python's built-in csv module is still enough, and it has nothing to install. But if you analyze big exports, the pandas upgrade is worth trying.

6. Next.js 16.4 Gives Your AI Agent a Bundle Analyzer

Next.js 16.4 improves the Turbopack Bundle Analyzer with a route summary page, a sortable table view, automatic snapshots you can diff, and a filter for the critical render path. It also adds an experimental agent skill called next-bundle-optimizer, installed with:

npx skills add vercel/next.js --skill next-bundle-optimizer

In the companion post, Vercel explains a classic trap: you lazy-load a heavy component with lazy(() => import('./HeavyComponent')), but if any other module in the same bundle imports it normally, its code still loads up front. The skill traces those import chains, reports the problems, and with /next-bundle-optimizer fix applies changes and compares snapshots. Vercel says agents cut nearly two megabytes of compressed JavaScript across v0 and vercel.com this way.

7. CheerpJ 5.0: Java 21 Runs in the Browser, Compiler Included

On November 2, Leaning Technologies released CheerpJ 5.0, which runs unmodified Java applications in a browser tab with no plug-in and no Java installation. Java 8, 11, 17 and 21 are fully supported, Java 25 is in preview, and the company commits to supporting each new Java LTS within six months of its release. Every version now ships the full JDK, so javac and jshell can run in the browser too.

For teachers and students, that opens the door to Java playgrounds and course exercises that compile code without a server. According to the announcement, the free Community license covers personal, educational and hobby use. Old Swing applications and applets can also live on in modern browsers.

What This Means for You

• Update your Python environments today. Upgrade the interpreter, then pip and certifi in every virtual environment, and uv if you use it. This is the one item on this list with real security risk.
• Leave Python 3.10 behind. It is end of life, and major libraries are already dropping it.
• Test your PHP login flows on 8.6 RC. Especially anything that relies on cross-site POSTs or reads the session cookie from JavaScript.
• Learn the patterns, not just the syntax. Whether or not Python gets ??, knowing the difference between "falsy" and None will save you from real bugs today.

Conclusion

This week's common thread is trust: which certificates your tools trust, which session IDs your PHP app trusts, and which code your bundler quietly loads. Most of the fixes take only a few minutes, but only if you actually apply them in every environment. Bookmark the official links above, and check back for our next developer news roundup.