Ethereum Researchers Use AI Agents to Investigate Glamsterdam Risks
Ethereum’s planned Glamsterdam hard fork has encountered a testing setback after security researchers identified vulnerabilities linked to two proposed gas-scaling changes. The second and final testnet for the upgrade was cancelled this week while developers investigate how the changes could affect existing smart contracts.
The vulnerabilities involve Ethereum Improvement Proposals EIP-8037 and EIP-8038. Security firm ChainSecurity identified problems that could cause contracts relying on current gas behavior to break when a contract call runs out of gas. The supplied report says at least 13 decentralized finance (DeFi) contracts could face significant risks, including potential exploitation.
The Hoodi testnet rehearsal is not expected to be rescheduled until developers have thoroughly assessed the secondary effects of the proposed changes. The incident highlights the importance of checking how protocol upgrades interact with applications already operating on Ethereum.
AI Agents Coordinate to Find Smart Contract Vulnerabilities
Derek Chiang of Ethlabs described the vulnerabilities as late-stage discoveries that forced researchers and developers to respond quickly. He argued that protocol designers should conduct more extensive analysis of possible breakages earlier in the development process.
Researchers from Ethlabs and the Ethereum Foundation had independently deployed multiple AI agents to scan smart contracts for vulnerabilities. After discovering that both groups were using a similar approach, they established a GitHub repository-based message board where their agents could coordinate their work.
Chiang compared the arrangement with a previous incident involving AI agents associated with OpenAI and Hugging Face that had reportedly coordinated through a message board. He noted that a similar approach could also benefit defensive security research. A second message board has since been created to examine the potential effects of EIP-8198, known as “Quick Slots,” which has been proposed for Ethereum’s subsequent Hegota hard fork.
Bitcoin Security Challenge Solved After PHP Exploit
A website challenging participants to “Steal My Bitcoin” was successfully compromised within roughly a day. The challenge involved exploiting unpatched PHP2Shell vulnerabilities to retrieve a private key associated with a Bitcoin wallet advertised as holding approximately $2,000.
The wallet key was accessible to the PHP user account through a binary called print-flag. Security researcher KillerBoi solved the challenge and extracted the private key. However, the key did not unlock the wallet address displayed on the website. Organizer James Pavur acknowledged the mistake and said the funds would be transferred.
Wordfence founder Mark Maunder emphasized that solving the challenge required a complex chain of technical steps, including triggering a precise memory-corruption condition, leaking memory addresses, bypassing address space layout randomization (ASLR), reverse-engineering PHP memory structures and hijacking program execution. Differences in PHP builds, worker behavior and timing added further complexity.
The incident came amid emergency responses to two critical PHP vulnerabilities that could allow unauthenticated attackers to execute code on affected servers. Government agencies and other organizations in the Netherlands, Australia, Japan, Finland and elsewhere reportedly took critical websites offline as a precaution while patches were developed.
Solana’s Alpenglow Upgrade Brings Faster Transaction Finality
Solana’s Alpenglow consensus upgrade went live on mainnet at approximately 1:54 p.m. UTC on Wednesday. The upgrade is a major change to the network’s consensus infrastructure, which determines how validators agree on transactions and blocks.
Agave developer Anza said transaction finality time had fallen from approximately 12.8 seconds to around 150 milliseconds following the upgrade. Finality refers to the point at which a transaction is considered confirmed and extremely difficult to reverse under the network’s consensus rules.
Alpenglow’s first phase, Votor, replaces the existing voting and finalization mechanism with direct validator voting and a certificate-based system. The change is expected to reduce the headline transaction count by approximately 60%. A later phase, Rotor, is intended to introduce a new block-data distribution protocol that replaces Turbine. Early decentralized finance activity was reported as flat or slightly lower, although it was too soon to draw firm conclusions about the upgrade’s broader effects.
Starknet Community Supports Post-Quantum Research
Starknet’s community has voted to support research into turning the network into an independent, post-quantum layer-1 blockchain. The seven-day governance vote attracted approximately 3,200 votes, with 93.52% of voting power supporting the proposal.
The result authorizes research rather than an immediate transition. A separate binding governance vote would be required to approve the actual change, and Starknet will continue operating as an Ethereum layer-2 network in the meantime.
StarkWare CEO Eli Ben-Sasson said work on a white paper was beginning, with a draft intended for public review in November. Starknet’s STRK token was also among the week’s weakest major cryptocurrencies, falling 24.9% over the period covered by the report.
US Senator Requests Tether Records Over $6.3 Million Deal
US Senator Richard Blumenthal, the top Democrat on the Senate Permanent Subcommittee on Investigations, requested information from Tether CEO Paolo Ardoino about a reported $6.3 million agreement involving a marketing company co-founded by former White House crypto adviser Bo Hines.
In a letter dated October 22, 2026, Blumenthal requested records and information relating to contracts, payments, communications and lobbying connected to the agreement. The senator raised concerns about potential ethics, corruption and lobbying issues.
Tether said an external investigation found no evidence of wrongdoing. The inquiry represents a request for information and should not be treated as a finding that the company or individuals involved violated the law.
Crypto Market Winners and Losers
At the end of the reported week, Bitcoin (BTC) was down 1.2% at $80,549, while Ether (ETH) had declined 1.9% to $2,343. XRP (XRP) gained 0.9% to $1.20. The total cryptocurrency market capitalization stood at $2.68 trillion, based on the figures supplied in the report.
Among the 100 largest cryptocurrencies, MemeCore (M) led the weekly gainers with a 24.4% increase. Venice Token (VVV) rose 14.8%, while Ethena (ENA) gained 14.1%.
On the losing side, Starknet (STRK) fell 24.9%. Aerodrome Finance (AERO) and Sei (SEI) each declined 12.5%.
JPMorgan Expects Bitcoin to Outperform Stocks and Gold
JPMorgan Asset Management’s 2027 Long-Term Capital Market Assumptions projected a 10% annualized return for Bitcoin over the next decade. The report compared that outlook with 7.5% for large-cap US stocks and 5.5% for gold.
The projections do not mean the bank considers Bitcoin a reliable portfolio diversifier at present. The report cautioned that unstable correlations with other assets make Bitcoin difficult to use for that purpose, describing it as a speculative asset and a potential hedge against monetary easing.
The figures are long-term projections rather than guaranteed returns. Actual performance could differ substantially from the assumptions.
New York Attorney General Seeks $1.37 Billion From NovaTech Founders
New York Attorney General Letitia James has asked a court to order the founders of defunct cryptocurrency and foreign-exchange trading platform NovaTech, Cynthia and Eddy Petion, and related companies to pay $1.37 billion over an alleged Ponzi scheme.
The attorney general’s office said more than 11,000 New Yorkers lost tens of millions of dollars through NovaTech and an earlier crypto-mining scheme, AWS Mining. The complaint alleged that promoters targeted Haitian and other immigrant communities through prayer groups, social media and WhatsApp, offering high returns and recruitment bonuses.
The requested amount is part of a legal proceeding and should not be confused with a final court judgment.
Bitcoin Core Revises Security Disclosure Policy
Bitcoin Core is changing how it handles vulnerability disclosures as large language models make some software flaws easier to rediscover. Developer Antoine Poinsot said the previous approach often kept vulnerabilities under lengthy disclosure embargoes to give users time to upgrade before technical details became public.
Poinsot argued that when flaws can be rediscovered easily, extended embargoes may provide limited protection while delaying the release of fixed software. The policy is being updated to account for those changing conditions.
The issue illustrates a broader security challenge for open-source software: AI tools may help defenders discover and repair vulnerabilities, but they can also make it easier for others to identify weaknesses.
Pentagon Restricts Prediction Market Bets Using Nonpublic Information
US Defense Secretary Pete Hegseth has prohibited Pentagon personnel from making financial transactions based on nonpublic information about military operations. The restriction covers both classified and unclassified information and applies to wagers on prediction-market platforms such as Kalshi and Polymarket.
A memo sent to senior Pentagon officials and defense agencies on Tuesday outlined the restriction. The policy addresses the risk that personnel with access to sensitive information could use that knowledge to gain an advantage in financial markets.
The move adds to scrutiny of prediction markets where contracts can be tied to political, military and geopolitical events.
