Bitcoin Lightning’s year-old security fixes still missing from 71% of flagged nodes

Nearly three-quarters of public Bitcoin Lightning nodes identified as exposed in August remained on affected software lines in October.An Oct. 21 study found that 71% of a group of 550 public LND nodes flagged during an Aug. 11 security disclosure were still operating on affected software release lines as of Oct. 13.Only about 10% had upgraded during that period, while 108 nodes were no longer classified as live. The findings suggest that security fixes are reaching some Lightning operators well after their release dates.The delays are particularly striking because patches for six vulnerabilities covered by the August disclosures had been available since LND version 0.19.0, released 446 days before the public warning.LND is one of the software implementations used to operate nodes on Bitcoin's Lightning Network, which processes payments outside the blockchain's main transaction layer.Lightning upgrades follow platform releases rather than security warningsResearch by Saurabh Kumar of Bitcoin Data Labs found that the network's largest software upgrade waves closely followed releases from Umbrel, a platform that packages Bitcoin node software.The three biggest waves involved between ...