ME News reports that on October 23 (UTC+8), Bitcoin Core updated its security vulnerability disclosure policy, defining easily discoverable vulnerabilities as those detectable through simple large language model prompts, and committing to promptly release patches for all actively maintained major versions alongside public security advisories.
Bitcoin Core developer Antoine Poinsot said that previously, vulnerabilities were typically kept confidential during extended disclosure embargo periods to allow users time to upgrade, but large language models have lowered the barrier to rediscovering some vulnerabilities, limiting the protective value of delayed fixes.
Low-severity vulnerabilities will be disclosed two weeks after the major release containing the fix; medium- and high-severity vulnerabilities will be disclosed two weeks after the end of life for the affected version, typically about one year after the fix is included in a new version. Critical vulnerabilities do not follow the standard policy and will be handled through an interim procedure.
In August, the volunteer organization Bitcoin Red Team reported nearly 5,000 potential issues across 390 projects, with about one-fifth of them successfully reproduced. That same month, Core Lightning developers requested node operators to upgrade or shut down their nodes and deferred public disclosure of technical details for two weeks. (Source: ODAILY)
Bitcoin Core Adjusts Its Security Vulnerability Disclosure Policy
KuCoinFlashShare
Summary
Bitcoin Core has updated its vulnerability disclosure policy, now classifying easily discoverable flaws as those identified through basic large language model prompts. These issues will be promptly patched in actively supported major versions, with advisories published accordingly. Antoine Poinsot noted that LLMs have made certain vulnerabilities easier to uncover, reducing the effectiveness of delayed fixes. Low-risk issues are disclosed two weeks after a patched version is released, while medium- to high-risk issues are revealed two weeks after the version reaches end-of-life, typically one year post-patch. Critical flaws are managed under temporary guidelines. In August, the Bitcoin Red Team flagged nearly 5,000 potential vulnerabilities. Core Lightning urged users to upgrade and withheld details for two weeks. Some of these cases may constitute security breach risks.
Source:Show original
Disclaimer: The information on this page may have been obtained from third parties and does not necessarily reflect the views or opinions of KuCoin. This content is provided for general informational purposes only, without any representation or warranty of any kind, nor shall it be construed as financial or investment advice. KuCoin shall not be liable for any errors or omissions, or for any outcomes resulting from the use of this information.
Investments in digital assets can be risky. Please carefully evaluate the risks of a product and your risk tolerance based on your own financial circumstances. For more information, please refer to our Terms of Use and Risk Disclosure.