Bitcoin Core speeds up security fixes as 44% of surveyed nodes run unsupported versions

Bitcoin Core merged a policy amendment on Oct. 22 that lets developers backport fixes for easily rediscovered vulnerabilities to every maintained release line and publish an advisory alongside them.

A network snapshot from Oct. 18 shows that 3,671 of 8,422 self-reported Bitcoin Core peers (43.6%) ran release lines that had already reached end of life.

The count comes from connected public peers in the Karlsruhe Institute of Technology's Bitcoin network monitor and reflects maintenance eligibility.

A node on an unsupported version can keep validating blocks correctly, and the figure doesn't measure compromise.

Under the old policy, medium- and high-severity vulnerabilities stayed under embargo until two weeks past the end of life of the last affected release.

That can mean about a year between a fix and the publication of its details. Long embargoes also discouraged openly backporting a fix, since the backport itself could reveal the flaw.

Antoine Poinsot argued in the Oct. 22 announcement that the arrangement fits badly with bugs that AI systems can rediscover:

“The embargo period achieves little but it delays the availability of a fixed release.”

Developers can now mark a flaw as easily discoverable during triage, a test based on how readily it can be found or rediscovered, including by large language models.

Those fixes go to all maintained major lines through point releases, with an advisory published alongside, and other vulnerabilities follow the standard severity schedule. Poinsot acknowledged a cost in an Oct. 20 discussion, noting that “mitigations won't have as much ‘bake time' in development branches.”

The new category awaits its first publicly identified use as of Oct. 23. AI-assisted campaigns such as Bitcoin Red Team's are producing large piles of candidate findings.

Bitcoin Core maintains its three newest major lines, currently 29.x, 30.x and 31.x. The snapshot found 3,243 peers on 31.x, 712 on 30.x and 635 on 29.x, with the 3,671 peers on 28.x and older already unsupported.

Once version 32.0 is formally released, 29.x leaves the maintenance window. If the sample stayed unchanged, 4,306 of 8,422 peers, or 51.1%, would sit on unsupported lines.

The measurement covers 8,422 Bitcoin Core peers among 9,691 connected IPv4 and IPv6 peers, so Tor-only and non-listening nodes fall outside it, along with infrastructure run privately by exchanges, custodians and miners.