No. The Python project sunset Python 2 on 1 January 2020 and says it will not improve it after that date, even if someone finds a security problem. The last release, 2.7.18, came out in April 2020. Anything still running Python 2 has had no upstream security fixes for years.
What the sunset page says
The python.org sunset notice says the volunteers stopped working on Python 2 on 1 January 2020. No new bug reports, fixes or changes are made. The 2.7.18 release in April 2020 bundled only fixes made before the cutoff, and its timing was for the release managers' convenience.
The practical effect: every flaw found in the interpreter, its standard library or its bundled tools since then has no upstream fix. Some operating system vendors and commercial providers have offered their own patches for a time. Those are separate arrangements, and each has its own end date, so verify what applies to you.
Where Python 2 still hides
You are unlikely to start a new service on Python 2. The risk is in what nobody touches.
| Place | Why it survives |
|---|---|
| Cron jobs and admin scripts | They work, so nobody reopens them |
| Build and deploy tooling | Written once, copied between repos |
| Embedded in vendor products | Shipped as an internal runtime |
| Old base images | The image tag never moved |
| Data science notebooks | Pinned to an old environment |
A quick search helps: look for #!/usr/bin/env python2, print " statements without parentheses, python_requires in setup files and FROM python:2 in Dockerfiles.
Move off it
- List every script and service. For each, find an owner. If there is none, that is your first finding.
- Decide: migrate, replace or delete. Many old scripts can simply be deleted once someone asks who uses them.
- For code you keep, use a tool such as
2to3orpython-modernizeto do the mechanical changes, then fix the rest by hand. Review diffs, because string and integer handling changed in Python 3. - Add tests before the conversion, even rough ones that check outputs.
- Target a current supported version, not the oldest Python 3. See our post on the Python 3.10 end of life.
- Retire the Python 2 runtime from the host so it cannot come back.
If you cannot migrate yet
Isolate it. Run it in a container with no internet access, drop its privileges, and make sure it never parses untrusted data. Be especially careful with formats such as pickle, which is unsafe on untrusted input in every version. See what to do instead of pickle.
Quick check
Does running Python 2 in a container make it safe?
A container limits the blast radius. It does not fix flaws in the interpreter. Combine it with network limits and minimal privileges.
Is it enough to switch the shebang to python3?
No. The code has to be compatible. A shebang change on an unconverted script usually fails.
Where Safeguard fits
Safeguard's asset discovery and SBOM scanning help you find old runtimes across hosts and repositories. The free scan covers the code side.
Sources
Last reviewed: 19 October 2026.
