Core Lightning (CLN), an open-source implementation of Bitcoin’s Lightning Network, has confirmed multiple vulnerabilities and urged node operators to install a forthcoming security update.

In an announcement on Thursday on X, Core Lightning said it had been assessing a high volume of AI-generated Common Vulnerabilities and Exposures (CVE) reports and found that several of them are real. The project advised operators not to shut down their nodes completely, but instead to restart them with “--offline,” a setting that prevents payments from entering, leaving or routing through the node.

The volume of submissions itself reflects a wider trend in open-source security: maintainers across projects have reported a surge in AI-generated vulnerability reports, most of them invalid. curl maintainer Daniel Stenberg, writing in early 2025, described a flood of machine-filed reports to his project that were almost entirely false. Core Lightning’s review, by contrast, concluded that several of the reports it received were genuine.

In a subsequent post, Core Lightning clarified that upgrading is its primary recommendation, and that restarting with --offline is an alternative for operators who have not yet upgraded. The guidance gives operators a way to protect their nodes until they upgrade, without shutting down the underlying software entirely.

Core Lightning explained the reasoning behind the advice: keeping the daemon active allows it to continue following the Bitcoin blockchain and to respond if a counterparty force-closes a channel, something a fully stopped node cannot do. The concern is structural to Lightning: either channel party can unilaterally broadcast a channel state on-chain, settling funds with transaction fees and built-in time delays, and a node that is not watching the chain cannot contest an outdated broadcast within that window. Many operators add watchtowers — services that monitor the chain on a node’s behalf — as an additional safeguard, though Core Lightning’s guidance in this case was to keep the daemon itself running. Operators who start their node with --offline were advised to remove the flag after upgrading; otherwise, their nodes will remain disconnected.

Core Lightning has not disclosed the nature or severity of the newly confirmed vulnerabilities, has not published CVE identifiers, and has not reported any related exploitation or losses. It has also not given a release date for the forthcoming update.

Core Lightning, formerly known as c-lightning and originally developed by Blockstream, is one of the major open-source implementations of the Lightning Network, alongside LND, maintained by Lightning Labs, and Eclair, maintained by Paris-based ACINQ, whose Phoenix mobile wallet is built on that implementation. The Lightning Network is a layer-2 protocol built on top of Bitcoin that routes payments through off-chain channels, allowing faster and lower-cost transactions than on-chain Bitcoin payments, and it underpins a range of consumer wallets and payment services. CVEs are standardized public identifiers used to track known security vulnerabilities in software.

The newly confirmed flaws are separate from remote denial-of-service vulnerabilities disclosed in May and July, which were patched in earlier releases. Both write-ups were published on the Delving Bitcoin forum only after fixes had shipped, consistent with the coordinated-disclosure practice, common in open-source security, of withholding technical details until a patch is available.