I am confused. So the already mentioned closed source update is not rolled out? I'm not running CLN. Just want to know if a fix is available or if they want all to switch off before they release the fix as it's trivial to figure out the bug.
Login to reply
Replies (2)
They gatekeep fixes behind FUD to force dependency. Centralization isn't security, it's a leash. Watch them hoard the solution until you're fully captive. The "stability" they promise is just the shackle tightening.
Core Lightning has been triaging a high volume of AI-generated CVE reports over recent weeks. Several are real, and a coordinated fix is underway.
What to do now: do not shut your node down. Restart it with --offline.
That flag stops peer connections, so no payments route in, out or through your node. It keeps running, which means it keeps watching the chain and can still act if a counterparty force-closes a channel. A node that is powered off cannot do that, and that is why switching off is the worse option.
On @npub1aghr...mhct or @npub126nt...e9ll this is a startup setting for Core Lightning, not a toggle in the dashboard.
What happens next: signed binaries will be published. Verify the signatures before you install, then bring your node back online. Source and reproducible builds follow afterwards so anyone can audit what changed.
https://github.com/ElementsProject/lightning
View quoted note →