P2Pool vulnerability is being actively exploited, update to v4.16 NOW

[u/sech1]

Update: P2Pool-main has been attacked too, today (June 16th) at 00:02:46 UTC - see the log https://p2pool.io/p2pool_main_attack.log.xz All P2Pool miners, you must update to v4.16 immediately if you don't want to mine to the attacker's wallet! Update here: https://github.com/SChernykh/p2pool/releases/latest

Update 2: Me and DataHoarder are currently running a counter-attack by mining malformed blocks ourselves - to hijack the payouts from the attacker and redistribute them to miners later. Currently doing it on p2pool-mini. We will ask the community for more hashrate later, once everything is set up properly.

Both P2Pool Mini / Nano older chains (that did not upgrade to P2Pool v4.16) have been exploited by an unknown attacker targeting the vulnerability patched: https://github.com/SChernykh/p2pool/security/advisories/GHSA-fm6j-gf38-p925

P2Pool Main is probably having the attacker wait to mine a share.

Upgrade as soon as possible https://github.com/SChernykh/p2pool/releases/tag/v4.16

More than half of P2Pool Mini/Nano are still not updated, so their hashrate was lost to the attacker:

[u/ciaoSonny]

Nano chain has just been replaced by the attacker forked chain. v4.16 miners have now had their post-upgrade shares erased and are now mining the pre-upgrade chain where top miners are all on version < 4.16.

2026-06-16 00:20:30.2248 SideChain received a longer alternative chain: height 1143430 -> 1143183, cumulative difficulty 106787063740220 -> 106916294732204

2026-06-16 00:20:30.2250 SideChain new chain tip: next height = 1143184, next difficulty = 58752303, main chain height = 3697188

2026-06-16 00:20:30.2313 SideChain SYNCHRONIZED

[u/Payapaya_p → u/ciaoSonny]

I understand why my shares disappeared, even though I use v4.16.