Researchers Disclose Solana PoH Clock Attack Vulnerability, Transition Risk Before Alpenglow Upgrade

The disclosure matters less for the bug itself than for its timing: a known weakness in the PoH clock is being aired publicly while the network is still mid-transition to Alpenglow, so the exposure window overlaps with the upgrade rather than closing before it. That puts validators and core client teams, not end users, on the front line of managing the handover, since clock integrity underpins ordering and timing assumptions across the chain. Whether the transition risk is resolved through client patches or deferred until Alpenglow lands is the open question to watch.