Leios rc-2026w44 landed on the leios-prototype branch, not on main, and Ubuntu still has no patch

Yesterday this desk said rc-2026w44 had not shipped. That is now resolved, and it is a prototype, not a node release. rc-2026w44 was published at 22:39 Central European time on 1 November, as a pre-release. It brings an egress scheduler, with a default EgressBudgetMbps of 250, adaptive endorsements that keep endorser blocks smaller until there are enough votes, TxSubmissionLogicV2, and per-pool BLS keys. It does not ask for a resync or a respin, it is compatible with w43, and it is meant for the Musashi Dojo testnet. At 20:43 on 1 November, ouroboros-consensus merged pull request 2475, Adaptive endorsements. At 21:15 the node merged pull request 6749, support for per-pool BLS keys. Both were merged into the leios-prototype branch, not into main. Leios is not on mainnet. Musashi Dojo is open for testing and is entering the Fire phase. The opening goal of that phase, 5 to 20 times the throughput, stays a testnet goal, not a mainnet tag.

The patch for CVE-2026-98432, CVSS 9.8, is still not in Ubuntu. On 1 November Anza warned Solana validators. Tim Garcia says the flaw is patched in the kernel, but not in Ubuntu. The temporary measures are to block TCP packets that carry IPv4 options, to turn off MPTCP, and to turn off request-socket migration. No compromised validators have been reported. On 31 October Intersect warned pool operators. Ubuntu 22.04, 24.04, 26.04, and 26.10 are vulnerable. Weekly 135 still asks for the patch and a restart as soon as Ubuntu publishes it. The protocol is not vulnerable. @realfludd gives commands for turning off MPTCP. @BSCNews reports that Cardano servers could be exposed. @JapaneseCrypto and @WallStreetXHQ carry the same item, with a Red Hat warning. @asscrusader420 writes that three days have passed and Ubuntu still has no patch. The tone is worried and technical. @FuturesWire asks whether ADA is at risk and attaches a trading call. That is FUD: ADA stays in delegator wallets even if a pool is compromised. At 03:55 on 1 November @IOHK_Charles wrote "This is why open source matters." Yesterday's desk already carried that sentence. The briefing marks it as interpretation.

Votes, the node, and the calendar

Around 14:10 Koios holds the PFMS proposal of 9.6 million ADA at 28 yes, 31 no, and 6 abstain. Yes power is 21.39 percent, against a 67 percent threshold. Yesterday it was 21.38. The constitutional committee has 1 yes. It expires in epoch 669, on 20 November. AURORA, 940 thousand ADA, is at 13 yes, 50 no, and 9 abstain. Yesterday the no count was 47. Yes power stays at 3.42 percent. The constitutional committee has 2 no. It expires on 20 November. Copper, 22 million ADA, is at 4 yes, 93 no, and 5 abstain. Yesterday the no count was 91. Yes power stays at 0.39 percent. The constitutional committee has 2 no. It expires in epoch 668, on 15 November. The information poll is at 3 yes, 2 no, and 23 abstain, power 0.32 percent, expiry 30 November. One pool voted no. That is also confirmed on gov.tools. No withdrawal is near the threshold. The treasury still stands at 1,392,896,975.26 ADA, up 3.62 million from epoch 664. Pending requests are about 32.54 million ADA, about 2.34 percent of the treasury. That is a calculation, not an approval.

cardano-node 11.2.0 is still the pre-release from 28 October. The latest stable release is 11.1.3, from 29 September. Tags 11.2.x and 11.3 do not exist. Weekly 135 is still the latest weekly review. Number 136 has not shipped. Version 11.2 holds the full Dijkstra scope except Leios. Dijkstra is the next ledger era. Version 11.3 brings Leios. A pre-release is three to four weeks away, and two weeks at the earliest. Node-to-client versions older than V_23 are no longer supported. The Hard Fork Working Group agenda for 3 November is published. The meeting is at 17:00 Central European time. The topics are the 11.2 release, issue 6672, and 11.3, which includes CIP-23, the Dijkstra risk log, scope-impact documentation in pull request 43, an updated Leios impact assessment, CAP-12, the London workshop, and funding the group from the technical steering committee budget. Minutes are not published yet. The last set is from 27 October. The workshop is on 12 and 13 November in London. Applications close on 5 November. Eleven implementations are on the list: Haskell, Amaru, Dingo, Dugite, TSUNAGI, Gerolamo, Dolos, Turbocardano, Razor, Scalus, and Yano. @IntersectMBO reminds people of that today at 12:48.

Dingo v0.90.3 shipped at 00:36 on 2 November, with chainsync, Mithril, and the ledger. Dugite corpus v20261101 is from 1 November. Mithril has an unstable release from 2 November. The latest stable is 2642.0, from 16 October. The DijkstraNet page did not respond today, so the current status is not available. The 2027 budget, according to CryptoSlate at 01:20 on 2 November, still has Intersect, PRAGMA, and the Cardano Foundation as stewards, and those stewards can themselves seek grants. DReps keep approval. There is also an Open Contributions route. Allocation procedures and conflict-of-interest handling are not specified. Concept submission is roughly 10 November, and a trial run is in 2027. CIP-0113 has not moved since 1 November. SongMarketCap today carries Dynamic Rewards, Ryan Wiley, split out of CIP-0163, as a faster spend of reserves. The same source carries CIP-0206, Quantova: an ML-DSA-65 signature of 3,309 bytes and an SLH-DSA-128s signature of 7,856 bytes, with a hard fork, in the same week as the post-quantum session at 15:00 on 4 November. A third piece the same day is a CPS on layer-1 data availability, Panagiotakos, five goals, with a Gummiworm window of one hour to five days and a Midgard window of seven days. Andreas Pletscher, chief operating officer of the Cardano Foundation, is on the Blockchain for Humanity panel in Geneva on Thursday, with UNHCR.

The calendar, Central European time. On 2 November the wanUSDC claims open. On 3 November come Binance's ZK proof of reserves and the Hard Fork Working Group at 17:00. On 4 November come the post-quantum session at 15:00 and the deadline for replies to the Bank of Korea. On 5 November London applications close, and epoch 665 ends around 22:44. On 6 November come Office Hours number 86, BlockSign, at 16:00, the Sundae poll deadline, and the day from which Brazilian banks may not deal with unlicensed crypto firms. On 10 November, the CEBP information action. On 12 and 13 November, the workshop in London. Around 00:24 on 13 November, the estimated bitcoin retarget. On 15 November, Copper expires. Still quiet: Hydra after 2.4.2 from 22 October, the Essential Cardano report after 23 October, Lace after 2.5.0 from 29 October, and Weekly 136.

Sources: Leios rc-2026w44, consensus 2475, node 6749, Musashi, CryptoSlate, Solana and the kernel, SongMarketCap, kernel, Weekly 135, @realfludd, @BSCNews, @JapaneseCrypto, @WallStreetXHQ, @asscrusader420, @FuturesWire, @IOHK_Charles, Koios, votes, gov.tools, Koios, treasury, cardano-node 11.2.0, HFWG, 3 November, @IntersectMBO, London, Dingo v0.90.3, Mithril, CryptoSlate, 2027 budget, SongMarketCap, Dynamic Rewards, SongMarketCap, Quantova, SongMarketCap, data availability, @Cardano_CF, Geneva.