ETH news: Ethereum clients patch flaw that could let attackers redirect ether rewards - CoinDesk

The vulnerability was discovered on October 17 when researchers found that private keys behind eight of eMudhra's intermediate certificate authorities had insufficient randomness. This cryptographic weakness meant the keys could be derived from the public certificates themselves, potentially allowing malicious actors to issue fraudulent certificates that unpatched software would accept as legitimate.

Risk to validators

Validators, which stake ETH to secure the network and earn rewards, could have been targeted by attackers positioned between a validator and the services it connects to. An attacker could impersonate these services and redirect block rewards to their own address. The most vulnerable setup involved fake external signers that could manipulate where rewards are sent.

Required updates

Docker users must install the latest Teku (version 26.10.3) or Besu (version 26.10.2) images, which stop trusting certificates linked to eMudhra. Operators running the software directly need to update Java separately, as the Ethereum software doesn't modify Java's certificate trust list. Those using Java 26 face additional challenges, as this version is end of life and won't receive patches, requiring a move to Java 25.