-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

0xCERT Security Advisory 0xCERT-2026-0249
============================================================

Advisory-ID:  0xCERT-2026-0249
Severity:     High
Published:    2026-10-16T10:53:52.000Z
Updated:      2026-10-16T11:07:18.312Z
Chains:       Ethereum
URL:          https://www.0xcert.com/advisory/0xCERT-2026-0249

Title: Besu 26.10.0: security release for Ethereum node operators

Summary
- -------
Besu 26.10.0 (released 2026-10-16) includes security fixes according to its release notes. Ethereum node operators running Besu should review and upgrade.

Details
- -------
Summary
Besu 26.10.0 (released 2026-10-16) includes security fixes according to its release notes. Ethereum node operators running Besu should review and upgrade.

Affected
- - Besu (hyperledger/besu) versions before 26.10.0

From the release notes
This release contains security fixes. Operators are advised to upgrade promptly. Details will be published in security advisories on besu-eth/besu after operators have had an opportunity to upgrade.
## Headline: Amsterdam scheduled on Hoodi
- - The Amsterdam hard fork is scheduled on Hoodi at timestamp 1793036568 (Mon, 26 Oct 2026, 17:42:48 UTC). Hoodi node operators must upgrade before then. [#11531]
## Action required on upgrade
- - Bonsai database auto-upgrade on first start (DB v4 / archive v3): stores jump-dest analysis alongside code. Takes a few minutes on mainnet, and the DB can no longer be opened by an older Besu afterward. A new besu storage revert-code-format subcommand can roll it back if you need to downgrade. [#11327, #11364]
- - Default discovery mode is now BOTH (DiscV4 + DiscV5 concurrently). Set --discovery-mode=V4 (or V5) to pin to one. [#11344]
- - Chain-pruning retent

Recommended actions
- - Upgrade Besu to 26.10.0 or later
- - Check the release notes for any coordinated upgrade deadline or required configuration change

Source & attribution
This 0xCERT advisory relays the Besu 26.10.0 release notes: https://github.com/besu-eth/besu/releases/tag/26.10.0. Refer to the upstream project for the authoritative record and any follow-up security advisories.

References
- ----------
- - https://github.com/besu-eth/besu/releases/tag/26.10.0
- - CVE-2026-8763
- - CVE-2026-13506
- - CVE-2026-68497
- - CVE-2026-91777

Verify with the 0xCERT OpenPGP key: https://www.0xcert.com/pgp.asc
Fingerprint: 5F94 3ED1 1E50 CF31 2128  C493 CCC7 D9EC 9415 723D

-----BEGIN PGP SIGNATURE-----

wrsEARYKAG0FgmrStkAJEDe9Tbcr+ZxrRRQAAAAAABwAIHNhbHRAbm90YXRp
b25zLm9wZW5wZ3Bqcy5vcmdW1qO/+nr1NjerQl1hTHtw5vB/IzDEjyVUEE12
nQvkWBYhBGCkkFZbJcT5QWu27ze9Tbcr+ZxrAABuMAD8DKZQSiPFE6tWtjZN
xq9xJ/y+7RdPJB68VcinB7v9CoMBAKJ/erYbbhClCHK0BIPKs+UZEJqyKTB8
wPGzlqc8IQoD
=NQkE
-----END PGP SIGNATURE-----