Core Lightning tells node operators to upgrade or disable routing during vulnerability embargo

The project says it has been validating a wave of AI-generated vulnerability reports and is preparing binaries containing fixes for many of the issues. The statement says the binaries will carry maintainer signatures and that the source code and vulnerability details will be published after a two-week embargo.

Offline means the node keeps watching the chain

Running Core Lightning with `--offline` cuts its peer connections. The node cannot send, receive or route payments in that mode, but it continues monitoring the Bitcoin blockchain and can respond if a channel counterparty tries to close with an outdated balance, CoinDesk reported.

That is an operational mitigation, not a shutdown of the Bitcoin network. The warning applies to software running Lightning nodes and does not establish a vulnerability in Bitcoin's base protocol.

What remains undisclosed

The maintainers have not said what the vulnerabilities allow, how many issues are being fixed or whether any have been exploited. Previous releases, including 26.04, are no longer supported, while the regularly scheduled 26.09 release remains planned for late September.

Operators should verify that any upgrade is signed by the project and should not treat social-media descriptions of the flaws as technical confirmation. Until the fixes and details are public, the supportable conclusion is narrower: Core Lightning has issued an authentic warning about several software vulnerabilities and recommends upgrading or disabling payment routing while keeping the node online.