Exchange Ranking
Top Exchanges
24h Volume Ranking
Popularity Ranking
Exchange BTC Balance
Proof of Reserves
Decentralized Exchanges
Funding Rate
Funding Heatmap
Liquidation Data
Max Pain
Long/Short Ratio
Whale L/S Ratio
Binance/Okex/Huobi L/S
Bitfinex Margin L/S
ETF Tracker
Solana ETF
XRP ETF
Hong Kong ETF
Bitcoin Treasuries
Crypto Reversal
Ethereum Reserves
HyperLiquid Wallet Analysis
Hyperliquid Whale Watch
Large Transactions
On-chain Movement
Bitcoin ROI
Stablecoin Market Cap
Options Analysis
News
Articles
Economic Calendar
Features
Wallet
Contract Calculator
Security
Collections
Watchlist
Following
BTC Bitcoin Core Lightning warns that vulnerabilities in AI-generated security reports are real
On Wednesday, Bitcoin Core Lightning notified node operators that the vulnerabilities pointed out in AI-generated security reports are real. The project party recommends that operators install the upcoming patch as soon as possible. Technical details will be kept confidential for at least two weeks.
The "-offline" flag allows node monitoring to be forcibly turned off
According to the project team's posts on the X platform, the correct thing to do is to wait for the patch to be released, verify its signature, and then "install it immediately, not delay it."
For operators that cannot be upgraded, the project party recommends keeping the node running and enabling the "-offline" flag instead of shutting down the node. This flag prevents a node from establishing a Peering Connection, so there will be no routes in, out of, or through the node. The software will continue to run and monitor the blockchain.
Lightning nodes must be wary of counterparties trying to forcibly close the channel. The shut down node cannot respond, so the project believes that shutting down is a worse option.
Project Core Lightning remains vague on specific details
The project team said on the Discord server that "a small team and external contributors" spent 10 days processing AI-generated vulnerability reports from multiple sources as part of a review that lasted for weeks. Details are kept secret for at least two weeks to allow developers time to provide fixes and give operators a chance to patch the vulnerability before it becomes public.
"We need clear advice: You don't need to shut down nodes. Our suggestion is to upgrade. When a patch is released, verify the signature and install it, executing it immediately rather than delaying it."-- For people who cannot upgrade, the alternative is to use the "-offline" logo.
Two posts on August 26 gave contrary instructions.
On August 26, Bitcoin developer Calle issued a red alert, saying that Blockstream developers had instructed users to immediately shut down its core Lightning node. Subsequently, the Core Lightning Project decided to clarify the facts. "We need clear advice: You don't need to shut down nodes." The project party wrote on X on Wednesday and reiterated that the recommendation was to upgrade, and if it was impossible to upgrade, use the "-offline" flag. The clarification received 29 retweets and 61 likes.
In early August, BTCPay Server urgently pushed a patch after attackers used a vulnerability to steal LND macaroon credentials. At the time, the project pointed out that artificial intelligence is a double-edged sword: it makes it easier for defenders to discover vulnerabilities and allows attackers to scan large open source code bases more cheaply.
The Bitcoin network is still running, but software built on it may have vulnerabilities. The software could be wallets, payment processors or Lightning Network tools. After a patch is released, node operators need to verify signatures before installation. Prior to this, the number, severity and any evidence of exploitation were unknown.
