Fresh off the press! XRPL Community Mag #8# on Real-World Utility just landed at our Paris office. We launch it next Monday in NY. In town? Grab a copy at our booth. Online version coming soon to our site, so stay tuned. #XRPLedger# @zsofi_b2

Security remains our top priority for preserving trust in the XRP Ledger (XRPL). Sharing a few thoughts following yesterday's disclosure of the critical payments engine vulnerability reported by Veria AI. First, this was a serious vulnerability, and we don't take that lightly. The bug had existed in the codebase for over a decade and could have allowed XRP to be created beyond its fixed supply. Fortunately, it was discovered through our bug bounty program before it could ever be exploited. Second, our response was fast and coordinated. The team developed and thoroughly tested a fix, worked closely with validators to rapidly upgrade the network, and secured the ledger before public disclosure. I'm proud of how everyone came together to address the vulnerability and protect the XRPL network. But there's a much bigger lesson here. AI is fundamentally changing how quickly vulnerabilities can be discovered. We have to move even faster than before, especially with a codebase that's been around for over a decade. This means we're doubling down in a few important areas: * Proactive security: Strengthening our bug bounty programs, expanding AI-assisted vulnerability discovery/adversarial testing, and continuously improving testing across releases. This discovery reinforces why these investments matter. * Addressing legacy tech debt: Working with our internal red team, external security researchers, and the XRPL Foundation to revisit longstanding assumptions in critical areas like payments engine, consensus, and P2P networking, guided by an updated threat model. * Accelerating formal verification of critical areas: Continuing our work with CommonPrefix and the XRPL Foundation to apply formal verification to critical parts of the protocol, with the goal of uncovering deeper issues that other approaches could easily miss. We will build on the learnings from formal verification of the Lending Protocol and Single Asset Vault. * Systemic hardening: Moving beyond individual bug fixes to identifying latent risks in older parts of the XRPL codebase and eliminating entire classes of vulnerabilities. Our goal isn't simply to find more bugs. It's to systematically address the underlying risks and make the XRPL harder to exploit. As the XRPL's role in global financial infrastructure grows, so does our responsibility to protect it. Security is never finished. We'll keep investing and improving alongside the broader XRPL community. Full disclosure for the 3.4.1 release:

Rippled v3.0.0 has officially been released, introducing five new amendments: • fixAMMClawbackRounding • fixIncludeKeyletFields • fixMPTDeliveredAmount • fixPriceOracleOrder • fixTokenEscrowV1 XRPK infrastructure is now running on the latest rippled v3.0.0 We urge all node operators to update promptly to avoid amendment block. #XRPL# #XRPCommunity# Release notes:

rippled 2.6.0 has been released! XRPK infrastructure is already running on it, with 271 nodes (25% of the network) upgraded. This update has no amendments to vote on. Huge thanks to all contributors, and we urge all node operators to upgrade. Source: @xrpscan @bithomp #XRPLedger# #XRPCommunity# #XRP#

The recent XRP Ledger security fix raised a lot of questions and some misconceptions. Let's clear them up. 1. Was any XRP created? No. XRP's supply was fixed at 100 billion when the XRP Ledger launched, and no transaction is allowed to create more. This bug was a way around that rule, and 3.4.1 fixed it 2 weeks ago. You don't need to trust us on this. All ledger data is public, and explorers and data sites read it every day. New XRP would show up in account balances for everyone to see. There is no hidden place for XRP on the XRP Ledger, every balance is public. We monitor the XRP Ledger 24/7 and have verified the supply throughout the history of the ledger. Others in the community verified this too, and anyone can do the same. Transaction fees are destroyed, so the supply is deflationary. About 99.986 billion XRP exist today. 2. How did this go unnoticed, and what's next? No normal payment comes anywhere near triggering it. It took hundreds of deliberately constructed operations. AI makes bugs like this faster to find, for the bad guys and the good guys. Together with RippleX and the community, we will ensure the XRP Ledger is protected against such vulnerabilities. This means radically applying Formal Verification and AI adversarial testing, collaborating closely with security researchers, and strengthening the bug bounty program. You'll hear a lot more about this as we progress. 3. XRP Ledger decentralization at the core of this. A public fix shows attackers where the bug is, and AI makes that fast. With a normal amendment vote, the fix would have been public for weeks before it took effect, risking network security. As a reaction to this, the XRPL community came together, and among them the XRP Ledger Foundation, RippleX, core devs and validators formed a social consensus and agreed on a path forward that involves shipping the fix directly. Patching a live network is never trivial, so the plan was also designed to minimize disruption for everyone running on it. We shared the build with the default UNL validators, using the contact details each one publishes in its xrp-ledger.toml file. Public binaries followed the same day, September 25. No single party could make that call alone. Every validator and node operator chooses what software to run, and 3.4.1 only became required through a normal amendment vote with more than 80% validator support for two weeks. Protocol changes still go through amendments. Big thanks to Cayden Liao and Veria AI for finding and reporting this responsibly, to the XRPL core developers for building and testing the fix, and to every node operator who upgraded so quickly, especially the validators. Full report: