Developers behind Core Lightning (CLN) advised users to upgrade to a forthcoming release or take their nodes offline.
Core Lightning, a Lightning Network implementation developed and maintained by Blockstream, said it had received multiple AI-generated vulnerability reports from several sources over a 10-day period.
Developers and open-source contributors have been working to validate the reports.
The project initially planned to publish a point release containing fixes within days. However, its remediation strategy subsequently changed. The team said it would make signed binaries containing fixes available while keeping information about the vulnerabilities under embargo for two weeks.
"During the embargo period, we strongly encourage everyone to upgrade," a Core Lightning maintainer said in a message.
Operators who do not upgrade were advised to restart their nodes. Previous releases, including version 26.04, will not be supported during the security response.
A "critical vulnerability"
Calle, a developer associated with the Cashu ecosystem, described the situation as a Єcritical vulnerability". He urged operators to shut down their Core Lightning nodes. C
Christian Decker, a prominent Core Lightning developer, said the team planned to release binaries while withholding source patches for 14 days to make it harder for attackers to reverse-engineer the fixes and develop exploits.
Calle questioned why users had to learn about the emergency through a screenshot of a Discord message instead of an announcement from the official Core Lightning account. The project later published an official warning for operators.
The precise nature and severity of the vulnerabilities remain undisclosed.
The project's latest publicly listed stable release is Core Lightning v26.06.6, released in July. Its next major release, v26.09, is scheduled for September.
