Core Lightning (CLN) node operators are being urged to disconnect from their peers while developers prepare signed binaries containing fixes for a group of undisclosed security vulnerabilities.

Bitcoin developer Calle amplified the warning on August 26 in a post on X, urging CLN operators to take affected nodes offline until patched software becomes available. Core Lightning's --offline setting prevents lightningd from binding to network ports or reconnecting to peers while still allowing operators to carry out local maintenance and monitoring.

The vulnerabilities have not been linked to confirmed thefts or to any exploitation in the wild. Technical details will remain under embargo for two weeks while the patched binaries are distributed.

Signed Binaries in Preparation

Core Lightning plans to distribute reproducible signed binaries carrying fixes for the vulnerabilities identified during a recent wave of security reports. Operators who do not upgrade are being told to restart their nodes with the --offline flag, cutting peer connectivity while preserving access to the node itself. Reproducible builds let third parties compile the same source independently and confirm their output matches the published binaries, giving operators a way to verify that emergency software corresponds to the patched code rather than trusting the distribution channel alone.

The project has also withdrawn support for older releases, explicitly including version 26.04. The latest publicly tagged build remained Core Lightning v26.06.6 before the emergency binaries were released.

Running offline does not simply shut down lightningd. The node can continue following Bitcoin and processing channel state locally, including force-close handling, while external Lightning peer connections remain disabled.

Core Lightning 26.09 remains scheduled as the next major release after the emergency security work is complete.

AI Reports Trigger Intensive Security Review

The security effort began after Core Lightning received a large volume of AI-generated vulnerability reports during August, forcing maintainers and outside contributors to validate the findings and develop patches across the codebase.

That review is unfolding alongside the much larger Bitcoin Red Team audit, which produced 7,958 findings across 501 open-source Bitcoin projects. Of those, 1,280 were initially classified as high or critical severity, although each finding still requires human validation before it can be treated as a confirmed vulnerability.

Bitcoin security teams have increasingly combined automated models with manual review following the Coldcard seed-generation failure. Coinkite recently shipped emergency Coldcard firmware after weak randomness exposed thousands of Bitcoin addresses, with losses reaching well above 1,700 BTC.

BitBox separately patched two severe vulnerabilities this month, including a memory-corruption path capable of arbitrary code execution under specific conditions, while Ledger recently patched a vulnerability in its Ethereum hardware-wallet app that could allow a malicious dApp to replace a transaction during the approval process.

Lightning Infrastructure Takes Precautionary Action

The warning affects Core Lightning rather than Bitcoin consensus or the Lightning protocol as a whole. CLN is one of the major Lightning implementations, alongside LND from Lightning Labs and Eclair from ACINQ, all of which interoperate through the BOLT (Basis of Lightning Technology) specification suite. Originally released under the name c-lightning and first developed by Blockstream engineers, the implementation is written in C and maintained under the Elements Project umbrella; it has operated on Bitcoin mainnet since 2018.

Because Lightning nodes hold Bitcoin in open payment channels and route payments for other users across the network, an implementation-level vulnerability warning is treated as an operational event for the entire operator base of that software, not just a single user.

Downstream infrastructure has already begun reducing exposure while the patched binaries are prepared. BTCPay Server disabled Core Lightning and Eclair routes in its default deployment as a precaution, adding another operational response to a month of security work across Bitcoin payment infrastructure.

No confirmed CLN-related fund loss had surfaced when the warning was issued. Operators remain directed toward the signed Core Lightning binaries once published, while vulnerability details stay under embargo for the two-week disclosure window.