Bitcoin’s Core Lightning project informed node operators on Wednesday that the vulnerabilities highlighted in AI-generated security reports are genuine. It advised them to install a patch that would come soon.
Technical details are kept under wraps for at least two weeks.
According to the team’s posts on X, the right move is to wait for the release, check its signatures, and install it “promptly rather than eventually.”
Operators who aren’t able to upgrade are encouraged to keep their nodes running with the `–offline` flag instead of shutting them down.
The offline flag precludes peer connections, so nothing is routed into, out of, or through the node. The software will continue to run and observe the blockchain.
A Lightning node must watch out for counterparties that are trying to force-close a channel. A switched off node cannot respond, which is why the project called shutting down the worse choice.
Core Lightning has been intentionally vague about specifics.
The team said on its Discord server that a “small team and outside contributors” expended 10 days working through AI-generated vulnerability reports arriving from multiple sources, part of a review stretching across several weeks.
Details are kept under wraps for at least two weeks to give developers time to present the fixes and operators a chance to patch before any vulnerabilities are publicized.
To be clear about what we are recommending: you do not need to shut your node down.
Our advice is to upgrade. When the release lands, verify the signatures and install it, and do that promptly rather than eventually.
–offline is the alternative for anyone who is not going to… https://t.co/rjq8Haz4pE
— Core Lightning ⚡️ (@Core_LN) August 27, 2026
On August 26, Bitcoin developer calle posted a red alert, saying that Blockstream developers were instructing users to shut down their Core Lightning nodes immediately.
Core Lightning then decided to get the story straight. “To be clear about what we are recommending: you do not need to shut your node down,” the project wrote on X on Wednesday, reiterating that the advice is to upgrade and, failing that, to use `–offline`.
The clarification obtained 29 reposts and 61 likes.
When BTCPay Server pushed an emergency patch in early August after attackers tapped a flaw to steal LND macaroon credentials, the project noted that artificial intelligence can be a double-edged sword, as Cryptopolitan reported.
It makes it easier for defenders to find bugs and cheaper for attackers to skim large open-source codebases.
The Bitcoin network is running, but the software that’s built on top of it might have bugs. The software could be wallets, payment processors, or Lightning tooling.
When the patch is released, node operators need to check the signatures before installation.
Until then, the number of vulnerabilities, their severity, and any evidence of exploitation are unknown.
The smartest crypto minds already read our newsletter. Want in? Join them.
