Medium

April

Test

Core

Bitcoin

<h2 style="margin: 30px 0 12px; font-size: 0.9em; letter-spacing: 0.12em; text-transform: uppercase; color: #6366f1;" id="key-takeaways">Key Takeaways</h2>
<div style="display: flex; flex-wrap: wrap; margin: 0 0 28px; border: 2px solid #6366f1; border-radius: 8px; overflow: hidden;">
 <div style="flex: 1 1 220px; padding: 16px 18px; color: inherit; border-right: 1px solid rgba(99, 102, 241, 0.35); border-bottom: 1px solid rgba(99, 102, 241, 0.35);"><strong>Medium, high bugs: disclosure roughly a year later</strong>
 </div>
 <div style="flex: 1 1 220px; padding: 16px 18px; color: inherit; border-bottom: 1px solid rgba(99, 102, 241, 0.35); background: rgba(99, 102, 241, 0.1);"><strong>Easy-to-find bugs: fixed releases as soon as possible</strong>
 </div>
 <div style="flex: 1 1 220px; padding: 16px 18px; color: inherit; border-right: 1px solid rgba(99, 102, 241, 0.35); background: rgba(99, 102, 241, 0.1);"><strong>Fixes go to 31.x, 30.x and 29.x</strong>
 </div>
 <div style="flex: 1 1 220px; padding: 16px 18px; color: inherit;"><strong>Version 28.x reached end of life in April</strong>
 </div>
</div>
<p>Bitcoin Core developer Antoine Poinsot committed the change to the project’s <a href="https://github.com/bitcoin-core/bitcoincore.org/commit/3e2cd6affc6c791c094ff4db15d40b22b204338e" rel="noopener noreferrer nofollow">security policy</a> on October 22. It is a disclosure rule, not a report of a new exploit, and it says nothing about Bitcoin’s cryptography or users’ private keys.</p>
<h2 id="why-ai-undercut-the-embargo">Why AI undercut the embargo</h2>
<p>The developers wrote that they had recently seen more reports of vulnerabilities that can easily be found, or found again. They attributed this largely to language models, which lower the bar for spotting certain classes of bugs and can also identify covert fixes: security patches merged into the code without being labelled as such.</p>
<p>That second point undercuts the purpose of an embargo. Bitcoin Core is open source, so a fix is visible in public code long before its details are published. If a model can recognise the change as a security fix, keeping quiet does little to hide the bug from attackers while still delaying a patched release for users.</p>
<blockquote style="margin: 24px 0; padding: 4px 0 4px 20px; border-left: 4px solid #6366f1; font-size: 1.1em; color: inherit;">
 <p style="margin: 0;">“The embargo period achieves little but it delays the availability of a fixed release.”</p>
</blockquote>
<p>Long embargoes also shaped where fixes landed. The developers wrote that their approach generally meant security fixes could not be backported to older versions and reached users only with the next major release.</p>
<h2 id="how-the-new-rule-changes-the-timeline">How the new rule changes the timeline</h2>
<p>The existing timelines, set out on the project’s <a href="https://bitcoincore.org/en/security-advisories/" rel="noopener noreferrer nofollow">security advisories page</a>, show how long that wait could be.</p>
<div style="margin: 22px 0; overflow-x: auto;">
 <table style="width: 100%; border-collapse: collapse; text-align: left; font-size: 0.95em; color: inherit;">
  <thead>
   <tr style="background: #4f46e5; color: #ffffff;">
    <th style="padding: 12px 14px;" scope="col">Category</th>
    <th style="padding: 12px 14px;" scope="col">When details go public</th>
    <th style="padding: 12px 14px;" scope="col">Where the fix ships</th>
   </tr>
  </thead>
  <tbody>
   <tr>
    <td style="padding: 12px 14px; border-bottom: 1px solid rgba(99, 102, 241, 0.3);"><strong>Low severity</strong></td>
    <td style="padding: 12px 14px; border-bottom: 1px solid rgba(99, 102, 241, 0.3);">Two weeks after a major release containing the fix</td>
    <td style="padding: 12px 14px; border-bottom: 1px solid rgba(99, 102, 241, 0.3);">Generally the next major release</td>
   </tr>
   <tr>
    <td style="padding: 12px 14px; border-bottom: 1px solid rgba(99, 102, 241, 0.3);"><strong>Medium and high severity</strong></td>
    <td style="padding: 12px 14px; border-bottom: 1px solid rgba(99, 102, 241, 0.3);">Two weeks after the last affected release reaches end of life, roughly a year after the fix first ships</td>
    <td style="padding: 12px 14px; border-bottom: 1px solid rgba(99, 102, 241, 0.3);">Generally the next major release</td>
   </tr>
   <tr>
    <td style="padding: 12px 14px; border-bottom: 1px solid rgba(99, 102, 241, 0.3);"><strong>Critical</strong></td>
    <td style="padding: 12px 14px; border-bottom: 1px solid rgba(99, 102, 241, 0.3);" colspan="2">Outside the standard policy; likely an ad hoc procedure</td>
   </tr>
   <tr style="background: rgba(99, 102, 241, 0.12);">
    <td style="padding: 12px 14px;"><strong>Easily discoverable (new)</strong></td>
    <td style="padding: 12px 14px;">With the fixed releases, in a security advisory</td>
    <td style="padding: 12px 14px;">A point release for every maintained major version, as soon as possible</td>
   </tr>
  </tbody>
 </table>
</div>
<p>Developers decide on the classification when they assess a report. They expect it to cover bugs that can be found with minimal effort, such as through a simple prompt to a language model, though it is not limited to AI discoveries. For these bugs, the severity-based embargo no longer applies.</p>
<h2 id="which-nodes-get-the-patch">Which nodes get the patch</h2>
<p>Bitcoin Core’s <a href="https://bitcoincore.org/en/lifecycle/" rel="noopener noreferrer nofollow">maintenance policy</a> covers the latest three major versions. When a new one is released, the oldest becomes end of life and generally receives no security fixes.</p>
<div style="display: flex; flex-wrap: wrap; gap: 10px; margin: 22px 0;"><span style="padding: 8px 14px; border-radius: 999px; background: #4f46e5; color: #ffffff; font-weight: bold;">31.x · maintained</span><br><span style="padding: 8px 14px; border-radius: 999px; background: #4f46e5; color: #ffffff; font-weight: bold;">30.x · maintained</span><br><span style="padding: 8px 14px; border-radius: 999px; background: #4f46e5; color: #ffffff; font-weight: bold;">29.x · maintained</span><br><span style="padding: 8px 14px; border-radius: 999px; background: rgba(128, 128, 128, 0.2); color: inherit; font-weight: bold; border: 1px solid rgba(128, 128, 128, 0.5);">28.x · end of life April 19, 2026</span>
</div>
<p>Nodes still running 28.x or older generally won’t receive these fixes. The project aims for a major release every six to seven months, and the next one, 32.0, will push 29.x out of the maintenance window. Bitcoin Core recommends running the latest maintenance release of the most recent major version an operator can upgrade to, and its <a href="https://bitcoincore.org/en/download/" rel="noopener noreferrer nofollow">download page</a> explains how to verify release checksums and signatures.</p>
<p>Backporting also depends on people. The lifecycle page notes that the bar for backporting a change rises as a version ages, and that there are not always enough volunteers to manage it. Maintenance capacity has shaped other decisions too, as the earlier debate over <a href="https://coindoo.com/bitcoin-core-privacy-network-healthy-nodes/" rel="noopener noreferrer nofollow">Bitcoin Core’s support for the CJDNS privacy network</a> showed.</p>
<div class="read-more pb-3 pt-3 pt-md-2 px-3 my-4 border bg-light">
 <h5 class="text-uppercase border-bottom mb-3 pb-1 d-none d-md-block">READ MORE:</h5><a href="https://coindoo.com/ethereum-pauses-glamsterdam-test-some-contracts-at-risk/" rel="noopener noreferrer nofollow">
  <div class="contentRight col-4"><span><img src="https://coindoo.com/wp-content/uploads/2026/05/ethereum-eth23.jpg"></span>
  </div>
  <div class="contentLeft col-8">
   <h4 class="title mb-0">Ethereum Pauses Glamsterdam Test – Some Contracts at Risk</h4>
  </div></a>
</div>
<h2 id="the-trade-off-and-what-to-watch">The trade-off, and what to watch</h2>
<p>The developers frame every security policy as a balance between transparency, which helps attackers and defenders alike, and giving users time to upgrade, something Bitcoin Core’s slow upgrade culture makes harder. Publishing an advisory alongside the fixed releases means details become public while some nodes still run unpatched software. For bugs attackers could find on their own, the developers judge that a quick fix matters more than keeping the details quiet.</p>
<p>The first security advisory issued under the new rule will show how quickly point releases reach all three maintained versions in practice. Separately, the release of 32.0 will narrow the set of nodes that can receive them.</p>
<p style="text-align: center; font-size: 0.9em;"><em>This article is provided for informational purposes only and does not constitute financial or investment advice. Node operators should follow official Bitcoin Core release notes and verification instructions.</em></p>
<p>The post <a href="https://coindoo.com/bitcoin-bugs-are-getting-easier-to-find-core-responds/" rel="noopener noreferrer nofollow">Bitcoin Bugs Are Getting Easier to Find: Core Responds</a> appeared first on <a href="https://coindoo.com" rel="noopener noreferrer nofollow">Coindoo</a>.</p>

Bitcoin Bugs Are Getting Easier to Find: Core Responds

Table of Contents

Coindoo.com

Other articles published on Oct 23, 2026

Join our free newsletter for daily crypto updates!