@@ -28,26 +28,35 @@ Python 3.12.15 is also a source-only security release, with security support con
 
 [Discuss this release announcement](https://discuss.python.org/t/python-3-10-22-and-3-11-17-are-now-available/109296).
 
-## Security content in Python 3.10.22 and 3.11.17
+## Security content in all five releases
 
-* [gh-158446](https://github.com/python/cpython/issues/158446): Fix crashes or incorrect output when formatting float or complex values with precision close to `INT_MAX`.
-* [CVE-2026-19553](https://www.cve.org/CVERecord?id=CVE-2026-19553) — [gh-156793](https://github.com/python/cpython/issues/156793): `ssl.SSLContext.wrap_bio()` now validates its `server_side`, `server_hostname`, and `session` arguments. `asyncio` also validates TLS `server_hostname` arguments. On Python 3.10 and 3.11, missing hostnames with `check_hostname` enabled emit `DeprecationWarning` for compatibility; they raise `ValueError` on Python 3.13 and later.
-* [CVE-2026-87910](https://www.cve.org/CVERecord?id=CVE-2026-87910) — [gh-157265](https://github.com/python/cpython/issues/157265): Apply tarfile extraction filters when a link falls back to extracting an archive member, skipping members rejected by the filter.
+* [gh-158446](https://github.com/python/cpython/issues/158446): Fix crashes or incorrect output when formatting float or complex values with precision close to INT_MAX.
+* [CVE-2026-19553](https://www.cve.org/CVERecord?id=CVE-2026-19553) — [gh-156793](https://github.com/python/cpython/issues/156793): `ssl.SSLContext.wrap_bio()` now validates its `server_side`, `server_hostname`, and `session` arguments. `asyncio` also validates TLS `server_hostname` arguments. On Python 3.10, 3.11, and 3.12, missing hostnames with `check_hostname` enabled emit `DeprecationWarning` for compatibility; they raise `ValueError` on Python 3.13 and later.
 * [CVE-2026-82049](https://www.cve.org/CVERecord?id=CVE-2026-82049) — [gh-157190](https://github.com/python/cpython/issues/157190): Fix a tarfile extraction-filter vulnerability involving hard links to symbolic links that could expose files outside the destination and change their permissions or modification times.
 * [gh-157953](https://github.com/python/cpython/issues/157953): Update bundled libexpat to version 2.8.5.
-* [CVE-2026-15310](https://www.cve.org/CVERecord?id=CVE-2026-15310) — [gh-156002](https://github.com/python/cpython/issues/156002): Bound `zipfile` decompression per read for bzip2 and LZMA members, preventing unbounded allocations from small compressed members. Third-party decompressors supplied by monkey-patching `_get_decompressor()` that lack `needs_input` and two-argument `decompress()` remain vulnerable.
+* [CVE-2026-15310](https://www.cve.org/CVERecord?id=CVE-2026-15310) — [gh-156002](https://github.com/python/cpython/issues/156002): Bound `zipfile` decompression per read for bzip2 and LZMA members, and for Zstandard members on Python 3.14, preventing unbounded allocations from small compressed members. Third-party decompressors supplied by monkey-patching `_get_decompressor()` that lack `needs_input` and two-argument `decompress()` remain vulnerable.
 * [CVE-2026-19672](https://www.cve.org/CVERecord?id=CVE-2026-19672) — [gh-155999](https://github.com/python/cpython/issues/155999): Prevent tarfile extraction filters from creating directories outside the destination for paths that leave it and then return.
 * [CVE-2026-19445](https://www.cve.org/CVERecord?id=CVE-2026-19445) — [gh-156293](https://github.com/python/cpython/issues/156293): Fix an ssl crash when an SNI callback switches contexts and the original callback context is no longer referenced.
 * [CVE-2026-17084](https://www.cve.org/CVERecord?id=CVE-2026-17084) — [gh-155292](https://github.com/python/cpython/issues/155292): Restrict stringprep and the IDNA codec to Unicode codepoint attributes defined by RFC 3454.
 * [CVE-2026-15806](https://www.cve.org/CVERecord?id=CVE-2026-15806) — [gh-155694](https://github.com/python/cpython/issues/155694): Scope urllib.request HTTPPasswordMgr credentials by URL scheme to prevent HTTPS credentials from being used for matching HTTP URLs.
 
-## Additional security fix in Python 3.10.22
+## Additional security content by version
+
+### Python 3.10.22, 3.11.17, 3.12.15 and 3.13.16
+
+* [CVE-2026-87910](https://www.cve.org/CVERecord?id=CVE-2026-87910) — [gh-157265](https://github.com/python/cpython/issues/157265): Apply tarfile extraction filters when a link falls back to extracting an archive member, skipping members rejected by the filter.
+
+### Python 3.13.16 and 3.14.8
+
+* [gh-158010](https://github.com/python/cpython/issues/158010): Update bundled OpenSSL to [3.5.9](https://openssl-library.org/news/secadv/20260929.txt). In Python 3.13.16 this applies to Windows, macOS and Android, moving from OpenSSL 3.0.21 to the 3.5 LTS series. In Python 3.14.8 it applies to Windows, macOS, Android and iOS. The source-only Python 3.10–3.12 releases do not bundle OpenSSL.
+
+### Python 3.10.22
 
 * [gh-149018](https://github.com/python/cpython/issues/149018): Improve protection against XML hash-flooding attacks in `xml.parsers.expat` and `xml.etree.ElementTree` when compiled with libexpat 2.8.0 or later.
 
 This XML hash-flooding protection was already included in Python 3.11.16.
 
-For the full details, see the [3.10.22 changelog](https://docs.python.org/release/3.10.22/whatsnew/changelog.html) and [3.11.17 changelog](https://docs.python.org/release/3.11.17/whatsnew/changelog.html).
+For the full details, see the [3.10.22 changelog](https://docs.python.org/release/3.10.22/whatsnew/changelog.html), [3.11.17 changelog](https://docs.python.org/release/3.11.17/whatsnew/changelog.html), [3.12.15 changelog](https://docs.python.org/release/3.12.15/whatsnew/changelog.html), [3.13.16 changelog](https://docs.python.org/release/3.13.16/whatsnew/changelog.html), and [3.14.8 changelog](https://docs.python.org/release/3.14.8/whatsnew/changelog.html).
 
 ## And now for something completely different
 
@@ -57,7 +66,7 @@ We started Python 3.10 with [a trip inside a Schwarzschild black hole](https://b
 
 This is Python 3.10’s ringdown. One last release before we switch off the release machinery. Five years of features, fixes, stubborn buildbots, and a rather unreasonable number of tarballs. I cannot quite believe I am writing the last one.
 
-Thank you, Ned and Steve, and everyone who contributed patches, reviewed changes, tested releases, reported bugs, or helped us get a release out when the universe seemed determined to prevent it. It has been a privilege to be your release manager for this series.
+Thank you to everyone who contributed patches, reviewed changes, tested releases, reported bugs, or helped us get a release out when the universe seemed determined to prevent it. It has been a privilege to be your release manager for this series.
 
 Python 3.11 still has another year of security fixes ahead of it, so you have not escaped me yet :)
 
@@ -68,6 +77,4 @@ Thank you to all the volunteers who made these releases possible. Please conside
 Your friendly release team,  
 [Hugo van Kemenade](https://discuss.python.org/u/hugovk)  
 [Thomas Wouters](https://discuss.python.org/u/thomas)  
-[Ned Deily](https://discuss.python.org/u/nad)  
-[Steve Dower](https://discuss.python.org/u/steve.dower)  
 [Pablo Galindo Salgado](https://discuss.python.org/u/pablogsal)