Core Lightning's maintainers told node operators to take their nodes offline unless they upgrade to a release that has not been published yet.
That leaves operators of one of Bitcoin's main Lightning implementations with a single available action — shutting the node down — and no public description of what they are defending against. Core Lightning, maintained by Blockstream with outside contributors, runs a share of a network carrying 375,019,291,916 sats, or about 3,750 BTC, across 33,101 channels and 16,420 nodes as of the Aug. 20 snapshot, per mempool.space.
The guidance came in a message circulated in the Core Lightning Discord and reproduced on stacker.news on Wednesday by an anonymous poster. Rather than shipping the point release it promised earlier this month, the team said it will publish binaries carrying fixes for many of the reported vulnerabilities while holding back what they fix.
“The details of the release will remain under embargo for two weeks,” the message said. “The binaries will be accompanied by the team’s signatures confirming reproducibility.”
“If you choose not to upgrade, we recommend taking your node --offline,” it continued. “Given the known risks, we will not support previous releases, including 26.04.” The message said the scheduled 26.09 release remains planned for late September.
