Core Lightning, an open-source implementation of Bitcoin’s Lightning Network maintained with support from Blockstream, has confirmed several security vulnerabilities in its software. The project urged node operators to install a forthcoming security update as the primary recommendation. For those unable to upgrade immediately, it advised restarting nodes with an offline configuration that blocks Lightning payments while keeping the software active.

AI-Generated Reports Lead to Confirmed Issues

Over recent weeks, the Core Lightning team received a large volume of AI-generated Common Vulnerabilities and Exposures reports from multiple sources. After triage and assessment, developers determined that several of the submissions identified genuine problems requiring fixes. The project stated that a coordinated response is underway.

Technical details about the newly confirmed flaws have not been disclosed. Core Lightning has not published severity ratings, assigned public CVE identifiers, or described the affected components or potential attack paths. No evidence of exploitation or related fund losses has been reported in connection with these issues.

The confirmed problems are distinct from earlier remote denial-of-service vulnerabilities disclosed in May and July of this year, which involved memory exhaustion in specific daemons and were addressed in prior releases.

Guidance for Node Operators

Core Lightning’s main recommendation is for operators to upgrade once signed binaries containing the fixes become available. The team plans to release these binaries first while withholding corresponding source code patches for two weeks. This approach aims to limit the ability of potential attackers to analyze the changes and develop exploits during the embargo period. The binaries will include signatures confirming reproducibility, allowing later verification against the source once it is published.

Operators who have not yet upgraded were advised against fully shutting down their nodes. Instead, they should restart with the --offline option. This configuration prevents the node from accepting peer connections or routing payments in, out, or through it. The daemon remains active, however, so it can continue monitoring the Bitcoin blockchain and respond if a channel counterparty attempts a force-close.

After installing the patched version, operators should remove the offline setting before restarting normally. Leaving it enabled would keep the node disconnected from peers.

Previous releases, including version 26.04, will not receive support during the security response. The most recent stable public release is version 26.06.6 from July. The next scheduled major release, version 26.09, remains planned for September.

Communication and Community Response

Initial guidance circulated through the project’s Discord channels before official posts appeared. Some community members, including a developer associated with the Cashu ecosystem, described the vulnerabilities as critical and called for operators to shut down Core Lightning nodes until the issues were resolved. Core Lightning later clarified that upgrading is the preferred path and that the offline mode serves as a temporary alternative for those awaiting the update.

Christian Decker, a long-time contributor to the project, noted that the team would provide ready-to-run binaries while keeping source patches private for the embargo period. Platforms that distribute Core Lightning packages, such as certain self-hosted server software, have begun issuing updates that apply the offline configuration by default pending the official security release.

Full public details of the vulnerabilities are expected once the two-week embargo lifts. In the meantime, node operators are directed to follow the project’s upgrade instructions and verify signatures on any binaries they install.