New research reveals widespread delays in patch adoption as public vulnerability warnings fail to accelerate software upgrades.

Nearly three-quarters of public Bitcoin Lightning nodes identified as exposed in August remained on affected software lines in October.

An Oct. 21 study found that 71% of a group of 550 public LND nodes flagged during an Aug. 11 security disclosure were still operating on affected software release lines as of Oct. 13.

Only about 10% had upgraded during that period, while 108 nodes were no longer classified as live. The findings suggest that security fixes are reaching some Lightning operators well after their release dates.

The delays are particularly striking because patches for six vulnerabilities covered by the August disclosures had been available since LND version 0.19.0, released 446 days before the public warning.

LND is one of the software implementations used to operate nodes on Bitcoin's Lightning Network, which processes payments outside the blockchain's main transaction layer.

Research by Saurabh Kumar of Bitcoin Data Labs found that the network's largest software upgrade waves closely followed releases from Umbrel, a platform that packages Bitcoin node software.

The three biggest waves involved between 262 and 385 nodes each, with at least 87% of participating nodes broadcasting updated software features within 48 hours of an Umbrel release.

However, Umbrel distributed those versions between 19 and 41 days after the corresponding LND releases, introducing another potential delay between developers making fixes available and operators receiving them through their preferred platforms.

Source link