Fixed Ethereum client flaw that could have redirected attacker rewards.
Ethereum client teams have released security updates after an authentication vulnerability created a possible way to redirect authentication blocking rewards.
Affected customers are not and kiss.
The problem originates outside of Ethereum in CA eMudhra, where researchers discovered that private keys behind eight intermediate CAs were dangerously weakly randomized.
An attacker able to exploit these credentials could impersonate services used by certain authenticators.
In the worst configurations, this can allow a validator to sign data that redirects a block reward to an address controlled by an attacker.
Teku released version 26.10.3 and Besu released version 26.10.2 to untrust certificates affected by their docker images.
Important: The default non-MAINNET nodes were not affected, and there are currently no reports of the vulnerability being exploited.
Operators using the affected Docker setups should update, while some installations that run Java directly also require a Java update.
Ethereum security doesn't stop at smart contracts.
The software, certificates and infrastructure around authentication are too important.