Key TakeawaysThe Glamsterdam upgrade will launch on Ethereum’s Sepolia testnet October 6, 2026Security concerns emerged around malicious actors exploiting free testnet tokens to disrupt block buildingBad actors could create numerous fake builder accounts, win auction bids, then refuse to deliver transaction payloadsDevelopment teams face a September 29 deadline for Sepolia-compatible releases, allowing just seven days for testingThe mainnet deployment timeline hasn’t been finalized, though Q4 2026 remains the target windowEthereum’s development team has officially designated October 6 as the activation date for testing the Glamsterdam upgrade on Sepolia. This announcement was accompanied by security warnings regarding a vulnerability that could compromise the testing process.ETHEREUM’S NEXT MAJOR UPGRADE IS MOVING FORWARD.Glamsterdam is scheduled to hit the Sepolia testnet on October 6, followed by a tentative Hoodi test on October 27.Developers have identified a potential weakness where attackers could create fake builder identities, submit huge… pic.twitter.com/79L6vjSf4I— MANDO CT (@MandoCT) September 18, 2026The security issue revolves around the block construction mechanism within Glamsterdam. This upgrade implements Enshrined Proposer-Builder Separation (ePBS), a framework where dedicated builders engage in competitive bidding to provide transaction blocks to network validators.While mainnet participation requires actual capital investment, Sepolia operates differently since test tokens carry no monetary value. This fundamental difference creates a unique vulnerability scenario.The Potential Exploitation MethodConsensus developer Potuz outlined the vulnerability during a September 17 development meeting. A malicious actor could generate numerous counterfeit builder profiles, place winning bids in block auctions, then withhold the required transaction information.I am not sure you are prepared for Glamsterdam on Ethereum pic.twitter.com/O57rRe7XDr— Ben {chmark} Adams ⟠ (@ben_a_adams) September 16, 2026“I can just spin up a thousand builders, rotate them, offer very high bids, and not produce payloads,” Potuz explained. “Any teenager can do this.”While this attack wouldn’t threaten actual assets, it could paralyze testnet operations and prevent developers from accurately assessing the upgrade’s functionality under authentic circumstances.Current protective measures appear insufficient. Some client safeguards activate only after multiple payload failures occur. Development teams noted that clients require mechanisms to permanently block specific builders, preventing attackers from repeatedly returning with fresh identities.Glamsterdam’s Core ObjectivesGlamsterdam represents Ethereum’s upcoming significant protocol enhancement. The upgrade aims to dramatically expand network capacity per block, with a target gas ceiling approaching 200 million—a substantial increase from the 60 million achieved in previous testing phases.Additionally, the upgrade extends the timeframe for broadcasting transaction payload information from approximately two seconds to nearly nine seconds, providing nodes with enhanced processing capabilities for larger block sizes.Devnet-11, a private testing environment, successfully executed a Glamsterdam transition on September 16. The network operated 84,000 validators distributed across various clients and pushed gas limits toward 200 million while maintaining network finality.Schedule and Future MilestonesClient development teams face a September 29 cutoff for delivering Sepolia-compatible software releases. This compressed timeframe provides only seven days preceding the October 6 implementation—considerably shorter than Ethereum’s standard 14-day period allocated for security audits and vulnerability identification.The development community accepted this accelerated schedule because Sepolia maintains a managed validator configuration that simplifies recovery procedures should complications arise.Following the Sepolia deployment, testing on the Hoodi testnet is provisionally scheduled for October 27. This timeline remains contingent upon Sepolia’s performance outcomes.A mainnet launch date remains unannounced. Ethereum’s development roadmap indicates Q4 2026 for Glamsterdam deployment, though specific block numbers or epoch designations haven’t been established. Production-grade builder infrastructure from Titan and Ultrasound teams has yet to successfully complete Glamsterdam fork transitions.The post Ethereum Schedules Glamsterdam Testnet for October 6 Amid Builder Attack Concerns appeared first on Blockonomi.