Tachyon v4.0.4 is out, and X1 Labs wants every validator on it within two epochs. Nicholas Pettas of X1 Labs posted the release in the X1 World Telegram today, marked urgent: "It's an urgent security update for the v4.0 line, and all validators must upgrade as soon as possible. All X1 Labs validators and RPC nodes are already running it. Details will be published in a security advisory once the network has upgraded."
The release was published on GitHub at 01:58 UTC on November 6. X1's public RPC endpoint already answers getVersion with solana-core: 4.0.4.
The upgrade itself is the easiest kind: a rolling restart, with no configuration, snapshot or ledger changes. The deadline is what makes it urgent.
The deadline: two epochs
v4.0.4 ships one new feature gate, loaderv3_programdata_size_floor, and it ships inactive. X1 will switch it on once the cluster has upgraded. A validator still on v4.0.3 at that moment will compute a different result from the rest of the network and diverge. Pettas set out the schedule:
Timeline:
• Epoch 436 (~Sat Nov 7, 21:00 UTC): the Delegation Program will require v4.0.4.
• Epoch 437 (~Sun Nov 8, 19:00 UTC): we activate the new feature gate. Validators still on v4.0.3 will fork off.
"We'll set the min validator version on the Delegation Program to v4.0.4 next epoch and activate the FG the epoch after," Pettas wrote, adding: "Thanks, everyone, for moving so quickly!"
The two steps hit different validators. The Delegation Program's minimum version is one of its published eligibility criteria (it read Tachyon v4.0.3 until now), so from epoch 436 a delegated validator on the old version fails that check. Epoch 437 then affects everyone, delegated or self-funded: a node on v4.0.3 simply stops following the cluster.
When we checked at 08:58 UTC today, mainnet was in epoch 434.
Where the network stands
We matched every vote account against the version each node reports over gossip, at 08:58 UTC on November 6:
| Version | Validators | Share of active stake |
|---|---|---|
| v4.0.4 | 171 | 83.55% |
| v4.0.3 | 197 | 16.45% |
By stake, the cluster is already well above the two-thirds supermajority that consensus needs: the large operators, X1 Labs included, moved within hours of the release. By headcount it is the other way round. More validators are still on v4.0.3 than on v4.0.4, and on average they are much smaller. Those are the operators who stand to lose their delegation at epoch 436 and their place in consensus at epoch 437 if they miss the announcement.
What is in the release
- A security fix, a backport of the upstream fix that Anza shipped in Agave v4.4.1 on November 5. X1 Labs is holding the details back until the network has upgraded, which is standard practice, and we are not going to speculate about them here.
- Dependency updates to
zstd,libz-sys,webpki-roots,webpki-root-certsandrustls-webpki, clearing six RUSTSEC advisories. - The new feature gate
loaderv3_programdata_size_floor(key6EEGb3bMQeaTNn3G1v983dDh6NnBHZFkMWWFiQojxor4). Per the release notes, it "charges a loader-v3 program's ProgramData account at least its metadata size during account loading". - Build tooling:
cargo-build-sbfandcargo-test-sbfare now pinned in the build wrappers.
How to upgrade
From the release notes:
git fetch --tags
git checkout v4.0.4
cargo build --release
./target/release/tachyon-validator --version
# x1-validator 4.0.4 (src:111c1c30; feat:b7543193, client:Tachyon)Check that the output shows feat:b7543193. Then restart between your leader slots:
tachyon-validator --ledger <ledger-path> wait-for-restart-window --min-idle-time 1
sudo systemctl restart tachyon-validatorOperators coming from v3.1 rather than v4.0.3 should read our v4.0.3 upgrade guide first: the removed flags and the port range change still apply. New operators can start from How to Run an X1 Validator.
A bad week for servers in general
Tachyon is not the only thing on a validator box that needs attention this week.
OpenSSH 10.6p2. Before Pettas posted, Jack Levin shared a report about an emergency OpenSSH release. Portable OpenSSH 10.6p2, released on November 5, works around a password authentication bypass in sshd on Linux systems that use the musl C library with PAM disabled, the default on Alpine Linux. The OpenSSH team learned of the bug only the day before. Damien Miller told affected admins to set PasswordAuthentication=no or turn SSH off "IMMEDIATELY". Systems built on glibc, which includes Ubuntu and Debian, or using PAM are not affected, and the OpenSSH team says the root cause sits outside OpenSSH itself.
The release notes are blunt about why the fix came out so fast. The team says it has seen several cases where a bug found by AI tools was then found again independently by someone else, which "suggests that adversaries who do not report bugs to OSS projects are likely to be able to discover these bugs too". OpenSSH will now ship fixes more often instead of batching them.
The Linux kernel. CVE-2026-98432 is a use-after-free in the kernel's IPv4 TCP connection setup, rated 9.8 by the kernel CVE team, that can lead to remote code execution without logging in. It has been in the kernel since version 4.4. On October 27 Anthropic's Frontier Red Team reported that an unreleased model had written a working root exploit for it in a lab, against a server with a multipath TCP listener. Red Hat shipped patches on November 1. Ubuntu's tracker, last updated November 5, still lists every supported LTS release as vulnerable, with fixed kernels in progress, and publishes an nftables rule that drops incoming IPv4 TCP packets carrying IP options. Ubuntu says the rule reduces the risk but does not fully prevent exploitation. Security researcher Marcus Hutchins reported internet-wide scanning that appears to target the flaw. No attacks using it have been confirmed.
That follows Copy Fail (CVE-2026-31431), the kernel privilege escalation disclosed in April that let an unprivileged user gain root on most major distributions.
Checklist for validators
- Upgrade to Tachyon v4.0.4 before epoch 436, and confirm
feat:b7543193in the version output. - Turn off SSH password logins if you have not already: key-only access,
PasswordAuthentication no. Check your key works and keep a session open before you reloadsshd. Even on Ubuntu, where this OpenSSH bug does not apply, there is no reason for a validator to accept passwords. - Watch for your distribution's kernel fix for CVE-2026-98432 and plan the reboot. A kernel update means a full reboot, so time it the same way as the Tachyon restart, outside your leader slots.
The security advisory for v4.0.4 will follow once the cluster has upgraded. We will cover it when it lands.