Core Lightning Tells Node Operators To Go Offline After AI-Found Bugs Turn Out Real
If you are running a Core Lightning node, this is not a story to skim past. Developers behind the software have issued an emergency warning after a wave of AI-generated vulnerability reports turned out to point to real, exploitable bugs.
HOW THIS STARTED
In a Discord message on August 13, the Core Lightning team said CLN had received a number of AI-generated CVE reports from multiple sources over the preceding ten days, and that its small team, working with open-source contributors, had been validating and triaging those reports and developing fixes where needed. That process led to what the team called a broader remediation strategy, starting with a point release bundling the fixes.
Two weeks later, the situation escalated. Developers asked node operators to make a security decision before they could fully assess the threat, with an Aug. 23 message posted on Stacker News urging operators to install new binaries that fix multiple reported vulnerabilities. Developer Calle put it bluntly on social media, and fellow contributor Murch flagged the severity of the issue the same day, both pointing operators toward taking nodes offline rather than shutting them down entirely.
WHY "OFFLINE" AND NOT "SHUT DOWN"
Confusion spread quickly about whether operators should power their nodes off. The developers were clear that they should not. Core Lightning told operators not to power their machines down, and to restart the software in a mode called "--offline" instead, which stops it communicating to other Lightning nodes while leaving it running. Lead maintainer Christian Decker explained the layered approach on the show's radar: a signed, binaries-only point release would ship within 48 hours, with the underlying source code and full technical details held under a two-week embargo to keep the fixes from being reverse-engineered by attackers before most operators have upgraded.
Previous releases, including version 26.04, will no longer be supported given the known risks, while the regularly scheduled 26.09 release remains on track for late September.
NO KNOWN LOSSES YET
As of this writing, there is no evidence anyone has lost funds. The available material provides no evidence of exploitation in the wild and no basis for treating every report as equally severe. The scale of the underlying scanning effort is still notable. Automated audits from the volunteer Bitcoin Red Team, the same group credited with flagging earlier issues this year, have been running across hundreds of Bitcoin open-source repositories and generating thousands of findings, most of which are false positives that still require a human to check.
LIGHTNING IS NOT DYING, IT IS GETTING PATCHED
The reflex from Lightning's critics has been to call this proof the network does not work. That reading misses what the vulnerability disclosure process actually is: bugs get found, validated, embargoed, patched and disclosed, and the network comes out more resilient on the other side. Lightning has quietly become load-bearing infrastructure for a growing stack of Bitcoin payment tools built on top of it, which is exactly why a bug here gets taken seriously rather than shrugged off. Operators running Core Lightning should update to the signed point release the moment it drops, or keep nodes running in offline mode until they can verify it.
This story comes from the Simply Bitcoin Live show. Watch the full episode.
