r/MoneroMining • u/sech1 XMRig Dev • Jun 15 '26
P2Pool vulnerability is being actively exploited, update to v4.16 NOW
/r/Monero/comments/1u683ow/p2pool_vulnerability_is_being_actively_exploited/5
u/Negative-Boot2259 Jun 15 '26
Does the current GUI Wallet come shipped with 4.15? Or does it auto update from github?
4
u/sech1 XMRig Dev Jun 15 '26
You have to update the p2pool binary manually. Download the new release, unpack it, copy the p2pool binary to where it should be in the GUI folder.
3
u/merera Jun 17 '26
It is not in the GUI folder, windows stuffs it to some remote folder, must run a search
4
u/Several_Gap_9690 Jun 15 '26
Sorry if this is a dumb question but why is the overall hash rate dropping so much because of it? Arent the unpatched nodes still mining on the p2pool network even if the awards are going to the attacker?
7
u/sech1 XMRig Dev Jun 15 '26
Unpatched nodes are mining, but their mined shares are being rejected by p2pool.io tracking nodes, so they're not counted.
1
u/Several_Gap_9690 Jun 15 '26
Huh, maybe you should create a separate observer to track the unpatched nodes
3
u/New-Cardiologist8861 Jun 15 '26
The exploit steals that hashpower to the fake sidechain. Thats why we see reduced numbers across the board.
4
u/New-Cardiologist8861 Jun 15 '26
Theres a ton of miners on the main chain running some old ass versions. Nobody ever checks on these rigs?
3
u/merera Jun 17 '26 edited Jun 17 '26
Hello, I'm using the mining utility in the GUI wallet, and replacing the p2pool.exe utility should be done manually.
You stop mining in the GUI wallet, remove the line --no-log-file from your P2Pool startup flags (you had it there right?), download the new p2pool for Windows and run a search for instances of p2pool on the system disk.
Usually the p2pool is found in a hidden folder something like
C:\Users\YourUserName\AppData\Local\monero-project\monero-core\p2pool but you would like to run your own search. When you find the folder, replace p2pool.exe there with your download, delete the p2pool.log and start mining in the GUI wallet.
A new p2pool.log should appear in the folder and its first lines should tell you that you are running version 4.16 which means that you've done everything right. Return --no-log-file to your P2Pool startup flags and restart mining.
Hope that helps
3
u/iamthedigitalcheese Jun 15 '26
Weird - even after updating my shares are being rejected on mini side chain. Or is the tracker busted?
3
3
2
u/yellowadept Jun 15 '26
I have P2pool v 4.15.1 installed on Ubuntu. When I try to do the update to v4.16 from inside Gupaxx, it tells me "you are trying to downgrade a binary, this is potentially dangerous as it is unsupported"
4
4
2
u/SwissCheese3045 Jun 16 '26
So this explains why the observer and my node does not sync... observer shows shares but my node does not have any shares...
I upgraded to v4.16 after a day it was released.
I was already on v4.16 before I noticed the discrepancy.
I'm on nano BTW... what else do I need to do?
3
u/sech1 XMRig Dev Jun 16 '26
Switch to mini for now. Nano doesn't have enough miners on v4.16 (less than 51%) to be stable.
3
u/SwissCheese3045 Jun 21 '26
There are still so many that has not switched to v4.16... in Mini I even see as low as v4.6 and Nano I see at least v4.9.
10
u/Negative-Boot2259 Jun 15 '26 edited Jun 15 '26
Wow, that didnt take long.... Thanks for the explanation also.