Bitcoin Core changes policy to speed up security fixes for outdated nodes
Bitcoin Core updates security fix policy amid high outdated node usage
Bitcoin Core merged a policy amendment on October 22, 2026, that allows developers to backport security fixes for easily rediscovered vulnerabilities to all maintained release lines. This change aims to reduce the time users wait for security patches, a process that previously could take about a year due to embargo periods.
The update comes as a significant portion of the Bitcoin network runs unsupported software. A network snapshot from October 18 showed that 43.6% of sampled Bitcoin Core peers were running versions that had already reached end of life.
Key numbers from the network snapshot
- 3,671 out of 8,422 self-reported peers (43.6%) were on unsupported release lines.
- If the sample remains unchanged, 51.1% of peers will be unsupported once version 32.0 is released and version 29.x leaves the maintenance window.
- The snapshot included 8,422 Bitcoin Core peers out of 9,691 connected IPv4 and IPv6 peers. Tor-only and private infrastructure nodes were not included.
Why the policy change happened
Under the old policy, medium- and high-severity vulnerabilities remained under embargo until two weeks after the end of life of the last affected release. This delay was problematic because Artificial Intelligence systems can now rediscover certain types of bugs quickly. Antoine Poinsot, who proposed the change, noted that the old embargo period "achieves little but it delays the availability of a fixed release."
Developers can now mark a flaw as "easily discoverable" during triage. This classification is based on how readily a bug can be found or rediscovered, including by large language models. Fixes for these bugs will be distributed through point releases with a public advisory. Other vulnerabilities will continue to follow the standard severity schedule.
Operator challenges and risks
While faster fixes help, they only matter if node operators install them. Upgrading Bitcoin Core is voluntary and involves operational work. For example, Core 32 changes the default format of partially signed Bitcoin transactions, which recently caused import issues in older multisignature setups. A high-severity vulnerability, CVE-2024-52911, was disclosed in May 2026, 388 days after the report was received in November 2024, illustrating the length of the previous embargo process.
Sources
Newisty Editorial Team covers technology, cryptocurrency, digital products, online platforms, developer tools and the wider digital economy. Our content is researched from official sources, company announcements, public documentation, market data and other primary or reputable sources. Articles are reviewed and edited before publication for clarity, accuracy and useful context.