Bitcoin Bugs Are Getting Easier to Find: Core Responds

On October 22, Bitcoin Core developer Antoine Poinsot committed a change to the project’s security policy adding a category for easily discoverable vulnerabilities. Under the new rule, details of such bugs are published with fixed releases in a security advisory, and point releases are issued for every maintained major version as soon as possible, rather than waiting through existing severity-based embargo periods. Developers said language models have made some vulnerabilities easier to find or find again and can identify covert fixes, undermining embargoes in open-source code. The policy covers maintained versions 31.x, 30.x and 29.x; version 28.x reached end of life in April. It is a disclosure rule, not a report of a new exploit.