Core Lightning Faces Urgent Security Alert Following AI-Generated Bug Reports
Core Lightning developers have issued an urgent warning to node operators to upgrade to an upcoming security release or take their nodes offline due to AI-generated vulnerability reports. Over a 10-day period, several bug reports were received from different sources using AI tools.
The team has not disclosed the details of the flaws but plans to publish signed binaries with fixes while keeping source-level information private for 14 days. This delay aims to make it harder for attackers to study the patches and build working exploits before most operators update.
Christian Decker, a Core Lightning developer, said that the team would hold back source patches for two weeks while signed binaries reach users. The latest stable public release is version 26.06.6, with version 26.09 scheduled for September.
No confirmed fund losses or active attacks have been reported so far. However, Bitcoin Lightning capacity has fallen to 3,998 BTC from 5,891 BTC in December 2025, a decline of 32.1% over eight months.