Ethereum client teams Teku and Besu released security updates in late October after researchers found that compromised certificate-authority keys from India-based eMudhra could allow attackers to impersonate external services used by validators.
Teku version 26.10.3 was released on October 27, following Besu version 26.10.2 on October 26. Both updates remove affected eMudhra certificate authorities from Docker images used by Ethereum nodes. The underlying issue was discovered on October 17, when researchers found eight intermediate eMudhra certificates relied on private keys that could be calculated from public information. Although eMudhra revoked the certificates, some Java installations continued to trust them because Java does not check revocation by default.
In vulnerable configurations, an attacker intercepting a validator's connection to remote infrastructure could impersonate a trusted service and redirect validator block fees or external signing requests to an attacker-controlled address. Teku stated that “a default Teku node on mainnet is not affected and needs no action” and reported no known exploitation. The risk applied mainly to setups using affected external services or separate Java runtimes, rather than ordinary user wallet balances.
Separately, developers corrected a flaw in the draft Glamsterdam upgrade rules after researcher avsetsin found a deposit-routing error. Under the earlier proposal, a builder and validator sharing one public key could have caused staking deposits to enter the builder's account. The revised rules use withdrawal credentials to distinguish validator deposits from builder deposits. The Hoodi testnet upgrade scheduled for October 26 was postponed, and the fix has entered Ethereum's specifications but still requires implementation across client software.
Node operators using standalone Java installations rather than Docker must update their Java runtime or trust store independently. Teku advised users on unsupported Java 26 to move to Java 25. In related security news, Google previewed a custody system that divides private keys among separate environments. The episode highlights infrastructure and supply-chain risks outside Ethereum's consensus rules, rather than a protocol exploit. For ETH markets, it is a reminder that infrastructure risk can arise outside the protocol itself, even when Ethereum continues producing blocks normally.
