Bitcoin Core speeds disclosure for easy-to-find flaws

Bitcoin Core has adopted a faster disclosure process for vulnerabilities maintainers judge easy to discover, requiring fixes across supported major releases and public advisories alongside the patched software. The policy change was merged on October 22. It creates a category for flaws that can be found with minimal effort, including those that might be identified through a simple prompt to a large language model. Maintainers will assess whether a reported vulnerability belongs in that category. For such flaws, Bitcoin Core’s policy calls for backporting fixes to all maintained major versions and releasing updates as soon as possible, with an accompanying security advisory. The approach replaces the longer disclosure embargoes that would otherwise delay public details and, in some cases, leave users waiting for a later major release to receive a fix. Developer Antoine Poinsot, who proposed the change, said reports of easily rediscovered vulnerabilities had increased. He attributed much of that rise to large language models lowering the effort needed to find certain bugs or identify fixes that had been made quietly. That explanation reflects Poinsot’s account of the reports;...