Ethereum Clients Teku and Besu Patch Certificate Flaw to Prevent Attackers From Stealing ETH Rewards

October 29: According to CoinDesk, Ethereum client Teku has released version 26.10.3 and Besu version 26.10.2, both of which stop trusting certificates associated with Indian certificate authority eMudhra in their Docker images. Researchers previously found that, due to a cryptographic flaw, the private keys of eight eMudhra intermediate certificate authorities could be computed. Teku said an attacker positioned between a validator and the service it connects to could impersonate that service, and a deceived validator might propose blocks that pay fees to the attacker's address, with forged external signers carrying the highest risk. Teku said default mainnet nodes are unaffected and no exploitation has been reported. Operators running directly without Docker need to update Java themselves, and users still on Java 26 need to migrate to Java 25, as Java 26 is no longer maintained.