Arbitrum pauses new Stylus activations in emergency security action

Arbitrum just hit the brakes on one of its signature developer features. The Arbitrum Security Council carried out an emergency upgrade on Arbitrum One and Nova on October 2, 2026, at 11:30 EST, pausing all new activations of Stylus contracts on both chains. The move targets vulnerabilities tied to the Stylus framework. Existing Stylus contracts are untouched: they can still execute and be renewed. This is a locked front door, not an evacuation. The upgrade also added a new safety mechanism to Arbitrum One’s dispute system, called a guard on the BoLD one-step proof. If contradictory proofs are ever accepted, that guard could delay unconfirmed withdrawals. What actually changed The emergency upgrade did two separate things. First, it stopped new Stylus programs from being activated on Arbitrum One and Nova. Stylus is the framework that lets developers write smart contracts in languages like Rust and C++, while keeping compatibility with the Ethereum Virtual Machine (EVM). Those programs compile to WebAssembly, or WASM, a compact low-level format for running code. The concern here centers on hand-crafted WASM programs that have not been patched. According to the research findings, su...