71% of Bitcoin Lightning nodes still on vulnerable software

A study found that 71% of 550 public LND nodes flagged for vulnerabilities in August remained on affected software as of October 13. Only about 10% upgraded during this period, while 108 nodes were no longer active. Security fixes for six vulnerabilities had been available since LND version 0.19.0, released 446 days prior to the public warning. Research indicated that the largest software upgrade waves on the network followed releases from Umbrel, with at least 87% of nodes updating within 48 hours of an Umbrel release. However, Umbrel distributed updates 19 to 41 days after corresponding LND releases, causing delays in security improvements. The study showed no significant acceleration in nodes moving away from affected software lines following public security warnings. Nodes using older software took an estimated median of 88 days to migrate to newer versions. At the time of the August disclosure, affected release lines represented 14.9% of live LND nodes but only 6.4% of channel capacity. The research highlights the need for improved distribution channels to expedite the adoption of security fixes across the Lightning Network.

This content is provided for general informational purposes only and doesn't constitute financial, investment, legal, or tax advice. Any events, rewards, online promotions, or related information mentioned herein should not be considered a recommendation, solicitation, or invitation to purchase, sell, trade, or otherwise deal in any crypto assets. Crypto assets are highly volatile and may result in loss. The availability of WEEX services, products, and related events may vary by region. You are responsible for ensuring that your participation is in accordance with applicable local laws and regulations.