Core Lightning has confirmed multiple security flaws in its Lightning Network implementation and is urging node operators to apply a forthcoming patch — or, until then, run their nodes in offline mode to reduce risk. What happened - Developers reviewed a batch of AI-generated CVE reports and found several of them described real issues that need fixing. Core Lightning says an official security release is coming and its primary recommendation is to install that update as soon as it’s available. - Pending the patch, operators who cannot immediately upgrade are advised to restart their Core Lightning daemon with the --offline option. That prevents the node from connecting to peers and stops it from sending, receiving, or routing Lightning payments while keeping the daemon active. Why --offline instead of stopping the node - Running with --offline keeps the daemon active so the node can continue following the Bitcoin blockchain and monitor channels. This is important because channel counterparties can publish transactions on-chain (for example, if a channel is force-closed), and a stopped node can’t perform that monitoring. - Simply stopping Core Lightning is not recommended because it leaves you unable to react to on-chain events. Once you’ve installed the patched release, remove --offline and restart normally to rejoin the Lightning Network. What’s not yet public - Core Lightning has not disclosed technical details about the confirmed vulnerabilities, their severity, or whether public CVE identifiers will be assigned. The project also hasn’t said which versions or components are affected, nor reported any evidence of active exploitation so far. Context and history - These newly confirmed issues are separate from DoS-related vulnerabilities disclosed earlier this year that involved memory exhaustion in connectd (peer connections) and gossipd (network gossip processing). Those cases could cause out-of-memory crashes and were patched before the current advisory. - The Lightning ecosystem and Bitcoin implementations have seen similar urgent fixes before. Examples cited by Core Lightning include LND’s 2023 memory-leak incident and past Bitcoin Core fixes addressing crash and privacy bugs (including CVE-2024-52911 and a PrivateBroadcast privacy fix), underscoring that critical updates periodically appear across the stack. What operators should do now - Watch for Core Lightning’s security release and apply the patch as soon as it’s available. That is the recommended course of action. - If you cannot upgrade immediately, restart Core Lightning with --offline to remain synced to Bitcoin without participating in Lightning network traffic. - After installing the patched version, remove --offline and restart normally to resume payments and routing. Takeaway Core Lightning validated several vulnerabilities flagged by AI-generated CVE reports and has given practical, immediate guidance to protect nodes before technical details and fixes are published. Operators should prioritize installing the official security update when it lands, using --offline only as a temporary mitigation to keep channel monitoring active while avoiding Lightning activity. Read more AI-generated news on: undefined/news