Core Lightning has confirmed multiple security flaws in its Lightning Network implementation and is urging node operators to install a pending security update as soon as it’s released. As an interim measure, the project recommended that operators who cannot immediately upgrade run their nodes with the --offline option to stop connections and payment routing while the daemon continues to monitor the Bitcoin blockchain. What happened - Core Lightning’s developers were triaging a large batch of AI-generated CVE reports and found several that identified real vulnerabilities requiring fixes. - Rather than publishing technical details, the team has told operators to prioritize installing the security release once it’s available. In the meantime, nodes can be started with --offline to disconnect from peers and block incoming, outgoing, and routed Lightning payments. - The project later clarified that --offline is a temporary protective setting while patches are prepared, and that upgrading to the fixed release should be the primary action once it’s released. Why --offline (and why not just stop the node) - Running with --offline keeps the Core Lightning daemon active so it can continue following the Bitcoin blockchain and react if a counterparty force-closes a channel. - A fully stopped node cannot watch the chain; if a channel partner publishes transactions to Bitcoin while your node is offline, you could miss the event and lose the ability to respond. That’s why Core Lightning recommends leaving the daemon running in offline mode rather than shutting it down completely. - After installing the patched version, operators must remove the --offline option; leaving it enabled post-upgrade will keep the node disconnected and prevent normal Lightning activity. What’s left unknown - Core Lightning has not released technical details on the confirmed vulnerabilities: there are no public CVE identifiers, no severity ratings published, no disclosure of affected components or versions, and no public evidence that any of the flaws have been exploited in the wild. - Operators must therefore rely on the instructions that accompany the forthcoming security release to know whether their installations are affected. Context and precedent - These newly confirmed issues are distinct from denial-of-service flaws disclosed earlier this year that involved memory exhaustion in connectd (peer handling) and gossipd (network gossip processing). Those earlier problems allowed remote peers to trigger unbounded memory use and were patched prior to this warning. - Security updates forcing operator action are not new across Bitcoin software. The article notes recent high-profile fixes in Bitcoin Core (including CVE-2024-52911, a block validation bug fixed in Bitcoin Core 29.0) and other Lightning client incidents: LND’s 0.16.3 memory-leak problem in mid‑2023 and replacement-cycling attack research that surfaced later that year. - Core Lightning said several AI-generated CVE submissions were valid, but stopped short of publishing exploit paths, affected functions, or reproduction steps while developers complete fixes. Practical steps for operators 1. Watch for the Core Lightning security release and install it as soon as it’s available. 2. If you cannot upgrade immediately, restart Core Lightning with the --offline option to prevent peer connections and payment routing while keeping blockchain monitoring active. 3. Do not fully stop the daemon unless you understand the risk of missing channel force-close transactions. 4. After applying the update, remove --offline before restarting so your node can reconnect and resume normal payments and routing. No losses or successful attacks have been reported in connection with the newly confirmed issues based on Core Lightning’s disclosure so far. Operators should treat the advisory as urgent: follow the upgrade guidance when the patch is published and use --offline only as a temporary mitigation. Read more AI-generated news on: undefined/news