Bitcoin Core Speeds Up Security Fixes as AI Makes Old Bugs Easy to Find

Bitcoin Core changed its security policy on October 22, 2026, so that fixes for easily rediscovered vulnerabilities can be shipped to older release lines within days instead of waiting out a year-long embargo, and the change comes as data from the Karlsruhe Institute of Technology shows 43.6% of sampled Bitcoin Core peers running software that no longer receives patches.

The amendment, merged into the project's site repository as pull request #1281 by developer Antoine Poinsot, ends the practice of holding medium- and high-severity bug details secret until two weeks past the end of life of the last affected release. Under the new policy, a developer can flag a flaw that takes little effort to rediscover, a judgment made during triage and one that explicitly accounts for tools like large language models turning up old bugs again. Once flagged, the fix gets backported to every maintained release line and published with an advisory. Bitcoin Core currently maintains its three newest major lines: 29.x, 30.x and 31.x.

Why AI ended the embargo

The old policy assumed a latent bug could stay hidden for a year. Large language models undermine that assumption: a flaw that one researcher found in 2024 is a prompt away from being rediscovered by anyone in 2026, so the secrecy window increasingly protects nothing. Poinsot, the policy's author, wrote on the bitcoindev mailing list that the change trades some caution for speed. The embargo period achieves little but it delays the availability of a fixed release," he wrote, adding that under the new policy mitigations won't have as much bake time'" in development branches.

The case that shaped the policy: CVE-2024-52911, a high-severity use-after-free in block validation, was reported to Bitcoin Core developers in November 2024, fixed in version 29.0 in April 2025, and disclosed on May 5, 2026, about 388 days after the fix. The flaw affected versions from 0.14.0 to before 29.0, and a crafted invalid block could crash a node. The new category has not yet been publicly used for a specific bug as of October 23.

Half the sampled network is outside the safety net

The timing matters because of who is running what. A KIT network monitor snapshot from October 18 counted 3,671 of 8,422 self-reported Bitcoin Core peers on end-of-life release lines, 43.6% of the sample. The snapshot counted 3,243 peers on 31.x, 712 on 30.x and 635 on 29.x. It covers only public IPv4 and IPv6 peers, so Tor-only and non-listening nodes, plus private infrastructure run by exchanges, custodians and miners, fall outside it.

The sample is about to tip. Bitcoin Core maintains three lines, so when version 32.0 ships, 29.x leaves the maintenance window; a frozen sample would push the share of peers outside the safety net past half: 4,306 of 8,422, or 51.1%. As of October 24, the download directory still listed only release candidates and the project's lifecycle page listed the 32.0 release date as TBA. The release notes also state that details of three medium- or high-severity flaws fixed in version 30.0 will go public two weeks after the new release, the old embargo rule still applying.

Version 32.0 brings its own upgrade hazard: it switches the default partially signed Bitcoin transaction format from version 0 to version 2. A user reported on October 14 that wallet files from the new graphical interface failed to import in older Core co-signers in a multisignature setup, and a fix was deferred toward version 32.1; RPC users can request the older format. Operators running older nodes, the same population that already misses patches after end of life on other platforms, face the choice between upgrading and leaving their software exposed.

Bitcoin has no central authority to force an upgrade, so the network's security rests on operators acting on their own. The policy change is written in that spirit: it acknowledges that obscurity no longer protects anyone, and that speed is the trade-off worth making.

The post Bitcoin Core Speeds Up Security Fixes as AI Makes Old Bugs Easy to Find appeared first on Techreport.