Monero published software version 0.18.5.4 on 16 October, describing it as a minor bug-fix release. Its two highlighted changes concern DNSSEC validation in the daemon and numeric conversion in JSON RPC requests.

What changed

The daemon fix covers DNSSEC validation used for checkpoints, blocklists and update checks. The associated code change adds a DNSSEC trust anchor; it was merged into the release branch on 13 October, before the public release announcement.

The RPC change restores conversion of strings into integers in JSON requests. That compatibility behaviour is temporary: the release notes say it is to be removed in version 0.19 as a breaking change.

NetNapz assessment: maintenance now, integration planning next

These are two different operational issues. The DNSSEC item concerns checks performed by node software; the RPC item concerns the interface through which other software communicates with it. Combining them into a claim about a new privacy feature would misrepresent the announcement.

For an integration that depends on numeric values encoded as strings, restored conversion may make the current release easier to adopt. It should not be treated as a permanent interface guarantee. A sensible next step is to identify affected requests and test their expected types before adopting the later major version. This is NetNapz’s assessment, not a claim that a particular exchange, wallet or merchant service has already completed that work.

The distinction also matters for XMR coverage: publication of maintenance software is not evidence of a token-price move, exchange support change or completed deployment across the network. This report does not establish those outcomes. Nor does the announcement alone establish a network-wide outage or an exploited vulnerability.

Use the official verification route

The project links downloads and a canonical GPG-signed hash list. It instructs users to verify both the downloaded file’s hash and the list’s signature. NetNapz checked the announcement and linked change, but did not download, execute or independently authenticate release binaries.

For operators, source authenticity and application compatibility are separate checks: a file matching an authenticated release does not prove a service’s own integration is ready. Testing and deployment decisions remain with the operator.

Sources and dates

• Monero official release announcement — 16 October 2026.
• Monero DNSSEC trust-anchor change, pull request 11542 — merged 13 October 2026.
• RPC conversion change, pull request 11552.
• Official signed hash list — linked verification resource, not independently authenticated by NetNapz.