Critical vulnerability in Core Lightning

[SatsPH]

Not sure if this has been shared here, in any case, for those running it, this is a must read.



https://x.com/callebtc/status/2092683963366064550

This @callebtc is part of the Bitcon Red Team that come into fruition after the Cordcard hack. And he is a heading a major security audit of the Bitcoin ecosystem and reporting those vulnerabilities that they have found.

[Luzin]

This @callebtc is part of the Bitcon Red Team that come into fruition after the Cordcard hack. And he is a heading a major security audit of the Bitcoin ecosystem and reporting those vulnerabilities that they have found.

I don't fully understand for sure. But I'm happy if they request audits for everyone involved with the Bitcoin ecosystem. Hopefully, this audit can provide a sense of security. Basically, any weaknesses or gaps found can be fixed immediately. So in the end, every user feels safe and comfortable using it. The hope is not just because of Cordcard and then this audit stops. The hope is that audits always exist and continue to be conducted because technology keeps evolving and is ongoing, and audits also continue. But will this audit be approved by the developers? They should feel happy because it helps them in developing their software. IMO

[Pmalek]

Core Lightning will release a new update soon. They suggest that all users update their software to the latest release after verifying the signature of the binaries. Those who don't want to or can't do it for some reason, should take their nodes offline. They don't recommend shutting nodes down. When they are offline, nodes won't have connections to other peers and can't route payments.

They aren't saying what's been discovered but it's safe to assume that it's significant. They will only release details to the public after a two-weeks waiting period. I guess the idea is to give users enough time to upgrade without the vulnerabilities being publicly available knowledge that can be further abused against the users.