Obol's required Charon security upgrade

What happened

Obol published a required Charon security upgrade on October 21, 2026, according to its official release.

What changed

Obol updated Go and removed trust in emSign/AAA certificate roots from the software image.

What did not change

Obol still requires another upgrade before Gloas/Glamsterdam.

Confirmed

• Obol identifies compromised certificates under CVE-2026-111943.
• Obol requires all operators to install the release.

Still open

• Obol does not establish operator adoption in the release.
• The release does not establish validator losses or compromised signing keys.

What it means for an advisor

• Ketju should review the Obol memo for certificate exposure and obtain upgrade confirmation from relevant operators.
• Advisors should establish whether covered staking providers use affected Charon installations.