Optimism operator security updates

What happened

Optimism published operator security updates on October 22, 2026, addressing compromised eMudhra certificates, according to its official releases.

What changed

Optimism distributed fixes for certificate validation in node, transaction submission and dispute software. Operators must install the updates to receive those fixes.

What did not change

Optimism states that the kona-host update leaves the proof program unchanged. The releases do not establish changes to bridge contracts or withdrawal terms.

Confirmed

• Optimism strongly recommends the October 22 updates for op-supernode, op-node, op-conductor, op-challenger and op-batcher operators.
• Optimism identifies compromised eMudhra certificates as CVE-2026-111943 in its release notes.
• Optimism reports fixes for 7 reachable vulnerabilities in the preceding op-conductor release.
• Optimism requires affected calldata operators to reduce their maximum transaction size to 261,909 bytes before updating op-batcher.
• Optimism exempts blob, auto and Alt-DA configurations from that calldata check.

Still open

• The releases do not establish which Optimism operators installed the fixes.
• Optimism does not report bridge losses or exploitation of these vulnerabilities in the cited releases.

What it means for an advisor

• Ketju should review the Optimism bridge memo’s operational assumptions and obtain evidence that relevant operators installed the security fixes.
• Ketju should check whether affected transaction submission settings could interrupt deposits or withdrawals during operator updates.