CLN warning from
@Stacker News (via Discord):
— Quoted content follows —
Like many open source Bitcoin projects, CLN has received a number of Al-generated CVE reports from multiple sources over the past 10 days. Our small team, together with several invaluable open source contributors, has been working intensively to validate and triage these reports and develop fixes where needed.
We're now working through a broader remediation strategy. The first step is a point release containing many of these fixes, and we will strongly recommend upgrading. We're aiming to have an initial version of the point release available within the next few days.
As the situation has evolved, so has our remediation strategy. Rather than publishing the point release this week we will make binaries available for a release containing fixes for many of the reported vulnerabilities. The details of the release will remain under embargo for two weeks. The binaries will be accompanied by the team's signatures confirming reproducibility.
During the embargo period, we strongly encourage everyone to upgrade. At the end of the two weeks, the full release and associated details will be made public.
If you choose not to upgrade, we recommend taking your node --offline. Given the known risks, we will not support previous releases, including 26.04. The 26.09 release remains planned for late September.
inb4 "Discord is a walled garden and you shouldn't use it." Stay uninformed then.
https://stacker.news/items/1555439
