[3.15] gh-160040: Add ssl eMudhra distrust entry to whatsnew (#160584)

Signed-off-by: Christian Heimes <christian@python.org>

Author: tiran

Doc/whatsnew/3.15.rst

@@ -2907,3 +2907,18 @@ that may require changes to your code.
   Use warning filters to silence them or additional :meth:`!assertWarns*`
   to catch and check them.
   (Contributed by Serhiy Storchaka in :gh:`143231`.)
+
+
+Notable changes in 3.15.2
+=========================
+
+ssl
+---
+
+* The :mod:`ssl` module now rejects TLS certificate chains that contain one
+  of a set of compromised eMudhra intermediate CA certificates.  The affected
+  certificates are identified by their public key, so cross-signed copies that
+  reuse the same key are blocked as well.  It is a defense-in-depth backstop
+  that applies even when an application supplies its own root CA bundle, and
+  regardless of whether the platform trust store has removed trust.
+  (Contributed by Christian Heimes in :gh:`160040` for :cve:`2026-115557`.)