Onslaught of AI-found bugs forces Bitcoin's Core Lightning into a secret 14-day emergency lockdown

Core Lightning developers have asked node operators to make a security decision before they can fully assess the threat. An Aug. 23 message posted on Stacker News urged operators to install new binaries that fix multiple reported vulnerabilities.

CLN told operators who decline the upgrade to run their nodes offline, and the team plans to keep the technical details under embargo for two weeks.

CLN plans to attach team signatures to the binaries so users can check provenance and reproducibility. Core Lightning’s documented release process uses signed tags, signed checksums, and reproducible builds.

Those controls let operators confirm that the package came through the intended release process.

Operators cannot yet inspect the evidence behind CLN’s threat assessment or determine the exploit mechanism from the public material. They also lack enough information to assess whether a particular node configuration faces the same risk.

Bitcoin gives users tools to verify monetary rules without asking a bank or payment processor for permission.

A live software security incident operates under a different constraint, as giving every user enough evidence to verify an exploit can give an attacker the same information.