BITCOIN CORE WILL FIX EASY-TO-FIND BUGS AT ONCE — POINSOT: THE EMBARGO “ACHIEVES LITTLE” — FIXES GO TO MAINTAINED VERSIONS ONLY, AND 29.X DROPS OFF WHEN 32.0 SHIPS

Bitcoin Core changed its security policy on October 22, 2026. Antoine Poinsot's pull request #1281 to the project website, opened October 16, was merged at 16:06 UTC on October 22 after four other contributors signed off, and he announced it the same day on the Bitcoin Development Mailing List. Bugs that triage flags as "easily discoverable" now skip the wait. The policy says the project "will publish a point release containing the fix for each maintained major version as soon as possible, along with a security advisory." It defines easily discoverable as findable "with minimal effort, such as through a simple LLM prompt."

The reason is in the pull request. The old rule held details back for months, and fixes often waited for the next major release. "Because of the nature of our project, coupled with a slow upgrade culture, our security policy favours a longer embargo period," Poinsot wrote. For bugs a chatbot can find, he added, "The embargo period achieves little but it delays the availability of a fixed release." Everything else keeps the old clock. Low severity bugs go public two weeks after a fixed major release. Medium and high go public two weeks after the last affected version reaches end of life. Critical bugs stay case by case.

Here is the part worth checking. The fast fixes go to maintained versions only. The project's lifecycle page says 29.x reaches end of life "after v32.0." At 11:10 UTC on October 23, bitcoincore.org had only test builds rc2 to rc4 for 32.0, no final release. When it lands, 29 joins 28 and older with no more patches. Our October 21 count found 10,259 of 21,813 reachable Core nodes, 47.0%, on 29 or older in Bitnodes data, and 49.6% to 56.1% in Luke Dashjr's data.

So the trade is this. An easy bug now gets a fix and a public write-up at the same time. A node on a maintained version can patch at once. A node on a retired version gets the write-up and no patch, and has to jump to a newer major version. You do not have to trust anyone to know which group you are in. Your node prints its own version. At the time of this writing, bitcoin was $81,574.