Python This Week — July 6, 2026: PSF Elections, ChocoPoC Malware, and 3.15 Nears the Finish Line

Welcome to this week's Python digest. The community gears up for election season and two major conferences, while a nasty malware campaign reminds us to read our requirements.txt files carefully.

PSF Board Election 2026: Nominations Open July 28

The Python Software Foundation has kicked off its 2026 board election cycle with four seats up for election, as the terms of Cheuk Ting Ho, Christopher Neugebauer, Denny Perez, and Georgi Ker come to an end. Nominations open on July 28 and close August 11; to vote, you must be a Contributing, Supporting, or Fellow member by August 25 and affirm your intention to vote. The PSF is also hosting office hours on its Discord in July and August for anyone considering a run (source).

Python Packaging Council Holds Its Inaugural Election

Alongside the board election, the community will elect the first-ever Python Packaging Council — a new body with broad authority over packaging specifications and a mandate to coordinate Python packaging efforts. The inaugural PPC election runs in parallel to the 2026 PSF Board election, marking a significant governance milestone for the long-fragmented packaging ecosystem (source).

ChocoPoC: Trojanized Exploit Repos Target Security Researchers

Researchers disclosed a malware campaign dubbed ChocoPoC, a Python-based remote access trojan distributed through at least seven fake proof-of-concept exploit repositories on GitHub. The malware hides in malicious requirements.txt entries (packages named frint and skytext), so simply running pip install to set up an exploit environment loads a compiled native extension that fetches the final payload. ChocoPoC steals browser credentials, cookies, and shell history, and cleverly uses a Mapbox dataset as a dead-drop command-and-control channel so its traffic looks like ordinary API calls (source, source).

Python 3.15 on Track: Release Candidate Phase Starts August 4

Python 3.15.0 beta 3 shipped on June 23 with roughly 195 bugfixes and improvements from 86 contributors, keeping the release on schedule for its release candidate phase opening August 4 and a final release planned for October 1. Headline features include PEP 810 explicit lazy imports for faster startup, the new high-frequency "Tachyon" sampling profiler, UTF-8 as the default text encoding, and substantial JIT compiler gains (source, source).

EuroPython 2026 Starts Next Week in Kraków

EuroPython celebrates its 25th anniversary July 13–19 in Kraków, Poland, expecting over 1,500 attendees at the ICE Kraków Congress Centre. The programme spans two tutorial days, three conference days with around 90 talks, and weekend sprints — with EuroSciPy following in the same city July 18–23. Remote tickets are still available (source).

SciPy 2026 Runs the Same Week in Minneapolis

On the other side of the Atlantic, the 25th annual SciPy conference takes place July 13–19 at the University of Minnesota in Minneapolis, with tutorials July 13–14, the general conference July 15–17, and developer sprints July 18–19. A big week ahead for scientific Python (source).

That's it for this week — see you next Monday, and if you're heading to Kraków or Minneapolis, enjoy the sprints!