Ethereum’s Glamsterdam Upgrade Hit by Second and Third Security Issues

Ethereum’s most important network upgrade of 2026 has run into trouble for the third time. According to OriginBrief’s weekly crypto report dated November 2, 2026, the Glamsterdam upgrade accumulated a second and third security issue during the week: a staking deposit routing bug and a certificate authority failure, piled on top of the gas-rule postponement from the previous period. The pattern, OriginBrief concluded, suggests Glamsterdam’s path to the main network is now measured in months rather than weeks, and the delay is widening the competitive gap with rival networks that have shipped major upgrades on schedule.

The story so far is one of careful progress interrupted at the final test stage. Glamsterdam activated on the Sepolia testnet on October 6, and developers had scheduled the next step, activation on the Hoodi testnet, for October 26. Instead, during the All Core Developers Execution meeting numbered 248, developers decided not to proceed with Hoodi, and the Ethereum Foundation announced on October 22 that the Hoodi schedule had been removed with no replacement date selected. The main network never had a confirmed activation date, so nothing was cancelled for ordinary users, but the testnet timetable that leads to a mainnet launch is now open-ended.

The Ethereum Glamsterdam delay matters because Glamsterdam is not a minor tune-up. It is Ethereum’s major scaling upgrade for 2026, combining changes to block construction, execution, and resource pricing. If it slips by months, every application, rollup, and institution planning around higher Ethereum capacity must wait, while competing networks use the interval to press their own advantages.

What Glamsterdam was meant to do

Glamsterdam bundles two halves. The first, called Amsterdam, covers the execution layer: the part of Ethereum that runs smart contracts and processes transactions. The second, called Gloas, covers the consensus layer: the part that agrees on which blocks are valid and in what order. Together they aim to let Ethereum process larger blocks safely.

Three components carry most of the ambition. Enshrined proposer-builder separation, known as ePBS and specified in EIP-7732, changes how block builders and validators coordinate, formalising a division of labour that already exists informally. Block-level access lists, under EIP-7928, let clients identify in advance which accounts and storage slots a block will touch, opening the door to parallelising work that is currently done step by step. Gas repricing, under EIP-8037 and EIP-8038, reworks how Ethereum charges for creating new persistent state, so that the cost of growing the network’s stored data is priced more accurately as blocks get bigger. All of them are about letting Ethereum do more at once.

The Glamsterdam gas rules problem in plain terms

The first problem, and still the most consequential, concerns the new gas rules. To understand it, think of gas as the fuel every Ethereum operation must pay for. Under the proposed EIP-8037 model, the cost of creating new persistent state is separated from the cost of computation: state creation draws first on a separate reservoir of state gas, while execution gas remains visible to contracts through the reading known as gasleft(). The idea is sound in principle, since storing data forever genuinely costs the network more than a one-off calculation, and pricing the two separately should make fees fairer as blocks grow.

The trouble, identified by security firm ChainSecurity in an analysis published on October 13, is what happens when an operation fails. Many smart contracts are written to call another contract, catch the failure, and then decide whether to retry, record a permanent error, or undo the whole transaction. Those failure handlers were written on the assumption that gas spent cannot come back during execution, so a handler that runs out of gas simply stops. Under the proposed rules, gas tied to state creation can be restored when that creation is undone, which means a failure handler that would previously have run out of fuel may now have enough to finish and commit a permanent state change.

ChainSecurity said it had found 13 real-world smart contracts that could be affected and was coordinating responsible disclosure with the projects involved. Developers agreed: rather than activate Hoodi on October 26 and hope the affected contracts were patched in time, they removed the Hoodi activation, the Gloas consensus activation, and a planned increase of Hoodi’s gas limit to 200 million from that date. The decision was widely described as the correct one, since a mainnet incident involving bridge messages, vault withdrawals, or liquidation workflows would have been far worse than a delayed testnet.

A second issue: staking deposits routed to builders

The second issue arrived the following week. OriginBrief reported that developers fixed a Glamsterdam bug, reported on October 27, that could have sent staking deposits to builders instead of to their intended destination. Staking deposits are the funds validators lock up to secure the network, so any flaw in their routing is treated as critical even if it only appears under testnet conditions. A deposit sent to the wrong party could undermine confidence in the mechanism securing billions of dollars of staked Ether.

The fix itself is reassuring in one sense: the bug was caught before mainnet, which is precisely what testnets are for. It is worrying in another sense, because it arrived immediately after the gas-rule postponement, suggesting that Glamsterdam’s interaction surface is large enough that new problems surface as soon as old ones are examined. Each fix also requires re-testing against every client implementation. The cumulative effect is not a single delay but a lengthening queue of verification work, and queues of that kind are what turn weeks into months.

A third issue: a certificate authority failure

The third issue was stranger, and it underlines how much modern blockchains depend on infrastructure far outside the chain itself. OriginBrief reported that a security failure at an Indian certificate firm affected Ethereum, requiring developers to rush out fixes on October 29. Certificate authorities are the organisations that issue the digital certificates browsers and software use to verify they are talking to the genuine party, and a failure at such a firm can ripple into any system that relies on those certificates to establish trust.

The incident shows how much a blockchain depends on ordinary internet infrastructure: when a certificate layer fails, developers must respond quickly whether or not the flaw is in Ethereum’s own code, because users experience it as an Ethereum problem.

The contrast with Solana Alpenglow finality

The contrast with Solana could hardly be sharper. Solana’s Alpenglow upgrade went live on October 22, according to OriginBrief’s monthly report, delivering a 150-millisecond finality target that had been in testnet since late September. Finality is the point at which a transaction can be treated as settled, which matters most to exchanges and merchants. Solana’s previous system needed around 12.8 seconds to reach finality, so the new target represents a dramatic improvement, though the 150-millisecond figure is a target under normal conditions, not a guarantee.

Solana’s win is not purely technical. Alpenglow was also Solana’s biggest network change since 2020, replacing a consensus system the network had run since launch, yet it activated on schedule while Ethereum’s equivalent programme stalled at the testnet stage. OriginBrief’s monthly assessment called it the month’s most visible competitive milestone and said it widened the finality gap between the two networks, reinforcing Solana’s positioning for payment and settlement use cases. The optics are poor for Ethereum: one network shipped its flagship upgrade while the other postponed its testnet for the third time.

Why repeated flags matter more than one delay

A single postponement is normal engineering. Repeated flags are a different signal, and they matter for three reasons. First, they suggest systemic rather than local risk, since the three issues touch different layers. Second, they consume scarce reviewer attention, pulling core developers away from mainnet preparation. Third, they change builders’ expectations. Application teams that planned launches around Glamsterdam’s capacity improvements must now decide whether to wait, to build for current capacity, or to hedge by deploying on faster chains, and each of those decisions leaks momentum from the Ethereum ecosystem.

None of this means Glamsterdam is in danger of cancellation. The Sepolia activation stands, the components are well understood, and the postponement itself is evidence that the safety process works: researchers flagged a problem, developers listened, and a testnet date was sacrificed rather than user funds. The honest reading is narrower but still serious. Ethereum’s scaling roadmap is intact, but its timetable is not, and the gap between the roadmap and the timetable is now the story. Until developers announce a replacement Hoodi date and resolve all three issues together, the prudent assumption is that Glamsterdam reaches mainnet months later than hoped.

Frequently asked questions

What is Glamsterdam in simple terms?

Glamsterdam is Ethereum’s major 2026 scaling upgrade, combining execution-layer changes called Amsterdam with consensus-layer changes called Gloas. It aims to let Ethereum process larger blocks safely. Ordinary users need take no action, since the delay affects testnet scheduling, not funds on the network.

Why did developers postpone the Hoodi testnet activation?

Developers postponed the October 26 Hoodi activation after ChainSecurity warned that the proposed gas rules in EIP-8037 could let smart contracts permanently record failed operations. Under the new accounting, restored gas might let a failure handler finish and commit a state change. The October 22 decision removed the Amsterdam and Gloas activations and a planned gas-limit increase to 200 million, with no replacement date set.

What were the second and third security issues?

The second issue, reported on October 27, was a bug that could have sent staking deposits to builders instead of their intended destination, and developers fixed it before mainnet. The third, addressed on October 29, was a security failure at an Indian certificate firm that affected Ethereum and required rushed fixes. Together with the gas-rule postponement, they extended timeline uncertainty.

How does Solana’s Alpenglow compare?

Solana’s Alpenglow upgrade went live on October 22 with a finality target of about 150 milliseconds, compared with roughly 12.8 seconds under its previous system. Finality means a transaction can be treated as settled and irreversible, which matters for exchanges and merchants. The figure is a target under normal conditions, not a guarantee.

Source: OriginBrief

Related reading on MM Crypto Analysis Web

• Ethereum ETF Outflows Hit $1.61B in Worst Month Ever
• Ethereum’s Glamsterdam Upgrade Delayed: What Matters Now for ETH Holders
• Devcon 8 Heads to Mumbai as Ethereum Debates Issuance and Delayed Glamsterdam

More in Ethereum on MM Crypto Analysis Web.