Researchers tested defenses against Monero peer flooding. Tor and Arti have security updates. Experimental mining releases remain for test networks.
1. Monero peer flooding and eclipse resistance
September 30, 2026 · Research watch
Affects Monero peer selection.
The public Research Lab meeting discussed a peer flood and simulations in which hostile peers could dominate outbound connections. An eclipse attack isolates a node from honest peers, limiting its view of the network. The discussion covered defensive changes to peer lists and selection. Simulation results were not proof that a live node had been eclipsed.
- Compare chain progress with independent references and investigate persistent peer concentration. Do not infer an attack solely from a large peer count.
2. Tor 0.4.9.13 and Arti 2.7.0 security updates
September 23 and October 1, 2026 · Security maintenance
Affects Tor and Arti installations.
Tor 0.4.9.13 is a carry-over item from September 23 that the preceding briefing missed. Arti 2.7.0 followed on October 1 with security fixes ranging from low to high severity. The Arti announcement specifically urges prompt upgrades for users of arti, arti-client and arti-ureq, especially when running onion services.
- Identify which Tor implementation is installed. These are separate projects with separate version numbers. Verify connectivity and onion-service reachability after updating.
Sources: Tor 0.4.9.13 security release · Arti 2.7.0 announcement
3. FCMP++ and mining beta releases are for testing
September 25–October 1, 2026 · Test networks only
Affects FCMP++ and Carrot test environments.
The FCMP++ and Carrot beta and P2Pool 5.0 beta support an experimental Monero network. They are not mainnet upgrades. Real funds do not belong in these test wallets.
- Use separate test data directories, test wallets and network configuration. Keep production keys and databases outside the experiment.
Sources: Stressnet beta 3.0 release notes · P2Pool 5.0 beta
Monero Research Lab — September 30, 2026
Phase 2 FCMP++ integration changes had merged, while Phase 3 proposals covering consensus verification were open for review. Developers were preparing a request for audit quotes and continuing multisig work. Licensing questions around mx25519 still blocked part of the Carrot integration.
Beta stressnet v3 was available. The peer-flood discussion described above came from this meeting, including preliminary simulations of changes to peer selection. Participants wanted further checks and testing against other attacker strategies before treating those results as a general defense.