Core Lightning Security Alert
Core Lightning, known for its role in Bitcoin’s Lightning Network as an open-source platform, is alerting node operators about the existence of critical vulnerabilities and strongly recommends an imminent software update for enhanced security. In a recent announcement, the team behind Core Lightning highlighted their review of a surge in AI-generated reports concerning Common Vulnerabilities and Exposures (CVE), identifying several legitimate threats among them.
Mitigation Measures
To mitigate risks before operators can implement the update, Core Lightning advises them to run their nodes in an “offline” mode. This method involves restarting the node with the command --offline, which keeps the node active without enabling transactions to be processed, thereby safeguarding it from potential attacks while awaiting the necessary upgrades. Importantly, Core Lightning emphasizes that it is best to perform the update rather than rely solely on offline operation, but this measure serves as a temporary workaround.
Vulnerability Details
The Core Lightning team has deliberately withheld information about the specifics and severity of these vulnerabilities, as well as any related exploit attempts or losses. The rationale behind keeping the node daemon active is to ensure it stays synchronized with the Bitcoin blockchain, allowing it to respond to potential threats, such as a forced closure of a transaction channel from a counterpart.
Post-Update Recommendations
For those opting to use --offline, it is crucial to revert back to normal operation after the software is upgraded; failure to do so will result in persistent disconnection.
It’s worth noting that these newly identified vulnerabilities are distinct from previous remote denial-of-service issues that had been revealed and addressed in updates during May and July.
