Core Lightning’s maintainers told node operators Sunday on Discord to restart with the –offline flag unless they upgrade to a release that has not been published. The instruction surfaced Wednesday through a repost on stacker.news. What the fix addresses will stay under embargo for two weeks.
The Discord message said the team has been validating AI-generated CVE reports arriving from multiple sources, and that it would publish binaries carrying fixes for many of the reported vulnerabilities before releasing the source code. Those binaries will carry maintainer signatures confirming reproducibility. Support for previous releases, including 26.04, has been withdrawn, while the scheduled 26.09 release remains planned for late September.
The Core Lightning team later confirmed the development in a post on X.
Nodes started with the –offline flag drop peer connections, so no payment routes in, out or through them, while the daemon keeps watching the chain and can still respond if a counterparty force-closes a channel. That is why the project told operators not to power down: a switched-off node cannot defend its channels.
Calle, the pseudonymous developer behind the Cashu ecash protocol, drew wider attention to the warning on X with sharper framing, telling users to shut nodes down immediately and calling the issue a critical vulnerability, language the project’s own message does not use.
The Core Lightning scare is the fourth Bitcoin infrastructure alarm in as many weeks. A 2021 Coldcard firmware bug that routed seed generation to a weak software randomizer has drained roughly $114 million in BTC since July 30. Swap bridge Boltz halted service indefinitely on Aug. 3, citing AI-assisted attacks. BTCPay Server told merchants on Aug. 7 to update or shut down over an actively exploited flaw. The common thread is AI-accelerated bug discovery, the so-called Bitcoin Red Team led by Calle earlier in the month reported 85 critical vulnerabilities across 390 projects.
Related Listen: The Chopping Block: ColdCard’s $100M RNG Hack, AI-Powered Security & Ethereum’s Staking Yield Taper
The post Core Lightning Warns of Several Vulnerabilities, Urges Operators to Disable Payment Routing While Fix Details Stay Embargoed appeared first on Unchained.
Powered by WPeMatico
