Core Lightning has been triaging a high volume of AI-generated CVE reports over recent weeks. Several are real, and a coordinated fix is underway.
What to do now: do not shut your node down. Restart it with --offline.
That flag stops peer connections, so no payments route in, out or through your node. It keeps running, which means it keeps watching the chain and can still act if a counterparty force-closes a channel. A node that is powered off cannot do that, and that is why switching off is the worse option.
On @umbrel or @start9labs this is a startup setting for Core Lightning, not a toggle in the dashboard.
What happens next: signed binaries will be published. Verify the signatures before you install, then bring your node back online. Source and reproducible builds follow afterwards so anyone can audit what changed.
hahaha
Do you know what startup setting specifically in start9 ? I don't see anything called 'offline mode' to turn on.
based on your explanation, i'm guessing we turn off all peer interfaces (including tor) and then restart the service.
disregard, appears start9 pushed an update to their service to do what you described automatically.
umbrelOS too.