Core Lightning Issues Urgent Security Warning for Node Operators

Core Lightning developers have issued an urgent security warning, instructing node operators to either upgrade to an upcoming patched release or immediately take their systems offline. The alert, issued on August 26, 2026, follows the discovery of several real vulnerabilities in the Bitcoin Lightning Network software, which were identified after the project received a wave of AI-generated bug reports.

The Core Lightning (CLN) team, a major implementation of the Lightning Network backed by Blockstream, announced that it had received multiple automated vulnerability reports from different sources over a 10-day period in August. Developers and volunteers then worked to validate the reports, separating genuine flaws from noise. The team confirmed that several of the reported vulnerabilities were real, prompting a shift from a routine update to a coordinated security release.

In response, developers are preparing signed binaries containing fixes, which they expect to make available within about 48 hours. However, the full technical details of the vulnerabilities will remain under a 14-day embargo. This strategy is intended to prevent attackers from reverse-engineering public code to...