Three months, three missed dates
Ethereum Glamsterdam has slipped for the third time in as many months. The Sepolia testnet fork now targets October 6, eight days past the September 28 date developers confirmed on August 20. That earlier date replaced an August 3 target the team abandoned when testing stalled. The mainnet window has moved too, from the first half of 2026 to sometime in Q4.
Every delay pushed the same problems forward: test networks that could not finalize blocks, consensus bugs that threatened to halt devnets entirely, and execution clients that could not agree on how to price new state creation under EIP-8037. Developers have cycled through nine devnets so far. None held.
The October 6 date carries a cost of its own. Client teams face a September 29 software release deadline, leaving just seven days for security reviews and bug bounty testing before the fork activates. Ethereum's standard upgrade process allocates fourteen. The team accepted the compressed window because Sepolia is centralized enough to recover from catastrophic failure, but the abbreviated schedule means fewer eyes on code that will eventually run a $250 billion network.
Devnet-11 ran 84,000 validators and found the same wall
The replacement test environment launched September 14 with a validator set sized to match mainnet conditions. Developers raised the block gas limit toward 200 million without losing finality, a milestone that earlier devnets could not clear. But the network still cannot finalize reliably under full load, and production builder software from Titan and Ultrasound has not completed its Ethereum Glamsterdam transition. Without stable builder infrastructure, the mainnet consideration clock does not start.
The upgrade introduces Enshrined Proposer-Builder Separation, moving the job of assembling transaction bundles onto Ethereum's core protocol. Right now that work happens off-chain through trusted relays. The change aims to reduce MEV extraction opportunities and decentralize a role that has concentrated among a handful of entities, but it also opens a new attack surface that has no effective mitigation yet.
Consensus developer: any teenager can stall Sepolia
Potuz, an Ethereum consensus developer, outlined the payload withholding attack during a recent call. "I can just spin up a thousand builders, rotate them, offer very high bids, and not produce payloads. Any teenager can do this."
The attack exploits free test ether. An attacker creates disposable builder identities, submits inflated block bids to win auctions, then withholds the promised transaction payloads. The network waits for a payload that never arrives. Validators can fall back to locally-built blocks after several misses, but the circuit breakers proved insufficient during earlier rounds of testing. There is no universal protection against individual malicious builders, and rotating identities makes blacklisting ineffective.
The vulnerability exists only on testnets where currency has no cost. Mainnet economics should discourage the same behavior, but Sepolia cannot simulate that constraint. Developers will be testing Ethereum Glamsterdam with a known exploit they cannot prevent. The question is whether the attack materializes on October 6, or whether bad actors wait for the production launch to apply pressure.
The faster cycle is running into its first real test
Ethereum moved to a predictable twice-yearly hard fork schedule in 2026, promising smaller, more frequent improvements instead of the multi-year gaps that defined earlier upgrades like the Merge. Glamsterdam is the model's first complex deployment, bundling consensus changes, execution-layer repricing, and a structural shift in how blocks are built.
Three delays, a halved security window, and an unmitigated attack vector suggest the cadence may be ahead of the infrastructure that supports it. A Hoodi testnet fork is tentatively set for October 27, though no mainnet activation date has been scheduled. The team that promised faster iteration is now measuring progress in postponed testnets.