Critical Vulnerability Detected in Bitcoin's Core Lightning

A critical vulnerability has been detected in Core Lightning (CLN), prompting developers to urge users to shut down their nodes immediately. This warning comes after security audits of Bitcoin's code, motivated by the hacking of Coldcard hardware wallets at the end of July, which resulted in the theft of over 2,000 bitcoins. The CLN team has received multiple reports of vulnerabilities generated by artificial intelligence in the past ten days. Blockstream has implemented a remediation strategy that includes the distribution of binaries with security patches, although technical details will remain under embargo for two weeks. During this time, operators are advised to update their systems or completely disconnect their nodes, as support will not be provided for previous versions, including 26.04. The decision to communicate the flaw via Discord has drawn criticism for the lack of general disclosure. At the end of the embargo, the complete version of the patches and details of the reported vulnerabilities will be published. Version 26.09 of Core Lightning is still scheduled for late September. Core Lightning (CLN) is a client that allows operating a node on the Bitcoin Lightning network, developed in C language and primarily maintained by Blockstream.