protocol
Ethereum postpones Glamsterdam Hoodi test after ChainSecurity flags EIP-8037
Core devs pulled the Oct 26 Hoodi activation and the 200M gas-limit test after a ChainSecurity note on EIP-8037/8038 contract-breakage paths. No replacement date.
Stories tagged: #security
explainer
Trail of Bits tests 25 package managers: only Go and vcpkg verify every package
A Trail of Bits audit of 25 package managers found fewer than half check lockfile integrity by default and only two verify every package they fetch — a direct supply-chain risk for crypto tooling.
explainer
Google Willow: magic state cultivation hits 99.99% T-state fidelity; what it means for Bitcoin Q-day
Google Quantum AI's October 15 Willow result cuts magic-state errors ~40×; it does not shift Q-day timelines, but validates the resource estimates behind post-quantum migration.
protocol
XRPL discloses a 10-year payment-engine overflow that could have minted XRP from nothing
XRPLF's October 9 disclosure describes an unchecked 64-bit overflow in the payment engine, present since 2015 and patched in rippled 3.4.1. No evidence of mainnet exploitation.
protocol
Zcash patches Orchard soundness bug with NU6.2 emergency hard fork
An under-constrained Orchard circuit could have minted undetectable counterfeit ZEC. Zcash froze the pool with a June 2 soft fork, then re-enabled it via NU6.2 the next day.
protocol
Zcash Zebra 4.5.0 patches P2SH sigop bug that risked chain split
Zcash Foundation ships Zebra 4.5.0 plus a 4.5.1 hotfix, closing 15 advisories including a critical P2SH disabled-opcode sigop undercount that could split the chain.