The XRP Ledger is moving toward a network cleanup upgrade that will close a token-permission flaw affecting issued assets such as stablecoins, with activation projected for November 4, 2026, around 14:46 UTC, according to XRPSCAN.
The fixCleanup3_4_0 amendment requires at least 80% support from trusted validators over a consecutive 14-day period. That countdown was reset on October 21, 2026 when support briefly fell to 26 of 35 validators. It has since recovered to 33 of 35 validators, above the 29-vote threshold, putting the amendment back on track for activation if support remains uninterrupted.
The amendment bundles corrections across multiple areas of the XRP Ledger, including Single Asset Vaults, Automated Market Makers, NFTs, Escrow, Multi-Purpose Tokens, transaction signing, sponsorship, trust lines, and permission delegation. A key fix addresses delegated PaymentBurn authority: under certain conditions, a delegate with burn permissions could cross a zero balance and mint new issued fungible tokens even without separate PaymentMint authority. This flaw has direct implications for stablecoin issuers and other regulated token issuers, because a partner authorized only to destroy tokens during redemptions could potentially create replacement tokens under specific circumstances.
The issue does not affect XRP’s own supply or allow arbitrary accounts to mint assets. Officials continue to recommend that issuers avoid delegating PaymentBurn until fixCleanup3_4_0 is live.
Separately, developers are preparing fixCleanup3_5_0, a future amendment aimed at closing authorization loopholes for regulated digital assets. The proposed changes would strengthen compliance controls for tokens that require issuer approval before accounts can receive them, particularly stablecoins and tokenized investment products. Unlike fixCleanup3_4_0, fixCleanup3_5_0 has not yet entered the main codebase and will need code integration and a separate validator vote.
Meanwhile, the XRP Ledger Foundation community director Hussein Zangana, known as Vet, warned node operators about a critical Linux kernel vulnerability affecting unpatched Linux servers running kernel versions 4.4 and later with exposed IPv4 TCP ports. Operators using RHEL 8/9/10, Debian 12/13, Amazon Linux, and Oracle UEK were urged to install security patches and reboot systems, while Ubuntu, AlmaLinux, Rocky Linux, and CentOS Stream administrators may need additional safeguards until patches are available. Zangana also advised reapplying protective nftables rules after system restarts or firewall configuration reloads.
