A Monero OpenSSL update reached the release branch. A separate HTTP logging fix awaited merge, and v0.18.5.3 was still being prepared.
1. Monero OpenSSL dependency moves to 3.0.22
August 31, 2026 · Track release inclusion
Affects Monero builds using bundled OpenSSL.
PR #11187 updates bundled OpenSSL to 3.0.22 on the release branch. Existing Monero binaries still contain the dependency they were built with. The patch does not establish that a Monero network interface exposes every issue fixed in OpenSSL.
- Identify whether your package uses bundled or system OpenSSL. Updating an operating-system library does not replace a copy compiled into a binary.
- Monero v0.18.5.3 was still in preparation at the briefing date.
Sources: OpenSSL dependency update
2. HTTP header log injection fix proposed
September 1, 2026 · Watch only
Affects HTTP request logging in monerod.
PR #11225 prevents malformed HTTP headers from placing misleading text in logs. It was still awaiting merge on September 4. The patch concerns the accuracy of log messages and does not report remote code execution.
- Treat unexpected log text as input requiring investigation. Follow the patch through merge and release before assuming a deployed package contains it.
Sources: Proposed HTTP logging fix
Monero Research Lab — September 2, 2026
Transaction-relay v2 changes had passed a major review for the next stressnet release. Hot/cold wallet integration was the remaining main task before beta v3. Developers were also reviewing upstream changes and answering questions from firms bidding to audit the proof code.
Relative locks remained under discussion as a possible foundation for payment channels. Participants considered funding work on a full protocol specification, rather than assuming that adding a consensus rule would make channels ready to use. No new activation date or production wallet feature was announced. Rucknium also outlined a simulation method for measuring how well spy nodes can identify the origin of a transaction.