Core Lightning, a Bitcoin Lightning software, confirmed that a vulnerability cited in an AI-generated security report is real and advised node operators to quickly apply a patch that will be distributed soon after checking it. Cryptopolitan, a blockchain media outlet, reported on Aug. 27 that technical details will not be disclosed for at least 2 weeks.

Core Lightning said there is no need to fully shut down a node. Once the patch is released, operators should verify its signature and install it immediately. Those who cannot upgrade right away were told to run the node with the '--offline' flag instead of turning it off.

Using the '--offline' flag blocks peer connections, stopping all routing into, out of, or through the node. The software continues to run and monitors the blockchain.

Core Lightning said this is why it recommended that approach over shutdown. A Lightning node must continually watch for attempts by a counterparty to force-close a channel. If a node is turned off, it cannot respond, so it saw a full shutdown as a worse choice.

The notice also corrects conflicting guidance issued a day earlier. On Aug. 26, Bitcoin developer Calle said Blockstream developers were advising users to immediately shut down Core Lightning nodes. Core Lightning later restated that upgrading is the priority, and that '--offline' is an alternative only when an upgrade is not possible.

Specific details of the vulnerability have not yet been disclosed. Core Lightning explained on Discord that a small team and external contributors reviewed AI-generated vulnerability reports from multiple sources for 10 days, and that the work continued for weeks. It is keeping details confidential for at least 2 weeks to give developers time to release fixes and operators time to patch first.

So far, the number and severity of the vulnerabilities and any signs of real-world exploitation have not been disclosed. The Bitcoin network continues to operate, but software running on top of it, such as wallets, payment processors and Lightning tools, could have bugs, so operators should first verify signatures after patches are released.