security patch

XRP Ledger

2026-10-12 02:33:48

XRPL emergency patch that skipped normal review keeps 10-year overflow flaw in focus

XRP Ledger developers said the network’s Sept. 25 emergency patch had to bypass the usual two-week amendment process because leaving the fix exposed for weeks would have given attackers time to study it. The patch addressed a long-running integer overflow bug in XRPL’s payment engine, one that disclosure materials say had been present since 2015 and could, under specially crafted conditions, let XRP be created out of thin air. The debate did not end with the release. Independent nodes later used the same line of inquiry to uncover four additional flaws, reinforcing concerns that the codebase may contain more overflow-related issues. At the same time, critics argued that the way the patch was distributed — initially as a binary release, with operators urged to upgrade quickly — showed signs of central coordination. XRPL Foundation and other participants pushed back, saying the decision was jointly assessed by the foundation, RippleX, core developers, and validators, and that each validator and node operator still chose what software to run. The episode has now widened into a broader argument over how decentralization should be judged during urgent security incidents.

70

XRP Ledger

2026-10-12 00:27:00

XRP Ledger Foundation says security bug did not mint new XRP, patch advanced through community consensus

The XRP Ledger Foundation has responded to questions around a recent security fix, saying the vulnerability did not create any new XRP and that the network’s total supply remains fixed at 100 billion tokens, as set when the ledger launched. According to the foundation, the flaw could have bypassed that rule under specific conditions, but it was patched in version 3.4.1 about two weeks ago. Public ledger data currently shows about 99.986 billion XRP in existence. The foundation also addressed why the issue was not discovered earlier. It said ordinary payment transactions were not enough to trigger the bug, which required hundreds of deliberately crafted operations. It added that AI is accelerating discovery on both sides, helping attackers and security researchers find this class of issue faster. On governance, the foundation said an open amendment vote would have exposed the location of the vulnerability too early. Instead, participants across the community, including XRPLF, RippleX, core developers and validator nodes, reached social consensus to release a direct patch. The mandatory rollout of version 3.4.1 still followed the network’s standard amendment voting process, requiring support from more than 80% of validators for two weeks.

50

XRP

2026-10-11 15:31:24

XRP Kuwait says coordinated node updates do not amount to centralized control

XRP Kuwait, an operator of a validator node, has pushed back against criticism that followed the rollout of the xrpld 3.4.1 emergency patch, arguing that near-simultaneous upgrades by validators should not be treated as evidence of centralized control on the XRP Ledger. The criticism emerged after nodes appeared to install the patch at almost the same time, prompting questions over whether the network retained meaningful validator independence. The patch addressed an integer overflow flaw in the payment engine that had existed since 2015. According to the report, the bug could let a sender lose only a very small amount while a recipient still received the full amount, effectively creating unauthorized XRP. A separate patch also closed a vulnerability tied to the Batch mechanism. Critics focused on the fact that a protection measure took effect immediately after the upgrade and was not approved through a network-wide vote, raising fresh questions about validator autonomy. The report cited U.Today as the source.

40

Bitcoin

2026-09-21 14:34:52

Bitcoin Core 32 enters release candidate testing with Oct. 10 target

Bitcoin Core 32 is now in release candidate testing, with developers aiming for an Oct. 10 launch, according to a post by Bitcoin News on X cited by ChainCatcher. The update is designed to speed up block validation by reading database data in parallel, though it does not change block production speed. On the wallet side, four wallet commands will default to a newer Partially Signed Bitcoin Transaction format, while the legacy format will remain available when needed. The release also includes security fixes. One patch blocks specially crafted wallet names from executing commands on non-Windows nodes. In a separate test, unauthenticated HTTP-related memory growth was reduced sharply, from about 3.2 GB to roughly 3 MB. The version is still under candidate testing, and the stated target date for release is Oct. 10.

370

Ledger

2026-08-27 03:07:00

Ledger says Ethereum app flaw was patched, users protected after firmware and app updates

Ledger Chief Technology Officer Charles Guillemet said the company’s Ethereum app did previously have a vulnerability tied to parts of the Clear Signing process, but the issue has already been fixed and deployed. According to Guillemet, the flaw was identified by Donjon, Ledger’s internal security research team, using an AI-driven vulnerability research tool, and the remediation was completed two weeks ago. He also said a smart contract security company that recently claimed to have found the bug only contacted Ledger’s bug bounty program after the fix had already been completed. Guillemet said that firm did not follow a responsible disclosure process, did not communicate with the bug bounty team, and later published material suggesting the issue was still unresolved. He added that users who promptly update their Ledger device firmware, the Ledger app, and related software will receive the latest security protections. The statement addresses recent claims around the Ethereum app and frames the issue as already remediated for users who install the available updates.

930

Bitcoin

2026-08-15 01:33:26

Core Lightning says security fix release is coming in the next few days

Bitcoin Lightning Network client Core Lightning said it has received AI-generated CVE reports from multiple sources over the past 10 days and is now reviewing them with open-source contributors. The team said it is verifying the reports, assessing the risks involved, and building the fixes it considers necessary. Core Lightning plans to ship an initial release containing several patches in the next few days. It also urged users to upgrade promptly once that version is available. At the same time, the project said it is working on a broader remediation plan. The update outlines an active response process rather than a finished resolution, with verification, risk review, patch development, and follow-up mitigation work still in progress.

1430