Sjors on Nostr: So the key is to run it in --offline mode, not turn it off entirely. ...

So the key is to run it in --offline mode, not turn it off entirely.

quoting
nevent1q…u3qv

Core Lightning has been triaging a high volume of AI-generated CVE reports over recent weeks. Several are real, and a coordinated fix is underway.

What to do now: do not shut your node down. Restart it with --offline.

That flag stops peer connections, so no payments route in, out or through your node. It keeps running, which means it keeps watching the chain and can still act if a counterparty force-closes a channel. A node that is powered off cannot do that, and that is why switching off is the worse option.

On umbrel (nprofile…cnv5) or Start9 (nprofile…06f3) this is a startup setting for Core Lightning, not a toggle in the dashboard.

What happens next: signed binaries will be published. Verify the signatures before you install, then bring your node back online. Source and reproducible builds follow afterwards so anyone can audit what changed.

https://github.com/ElementsProject/lightning