BITCOIN CORE DISCLOSES THREE BUGS — ONE PEER COULD CRASH ANY WINDOWS, MACOS OR BSD NODE — AN LLM SCAN FOUND ALL THREE — 29.5 SHIPS A DAY AFTER 29.X END OF LIFE

On October 28, 2026, Bitcoin Core published three security advisories. The worst one hits nodes on Windows, macOS and BSD. A peer sends TCP urgent data, a rarely used kind of network signal, and slips past the limit on how much a node will queue for it. The advisory says that “a malicious peer can trivially crash any Windows, macOS or BSD node it is connected to.” Linux nodes were not affected. The fixes are in 29.5, 30.4, 31.2 and 32.1.

The second bug is also rated medium. A peer that pretends not to support BIP 31 pings never gets cut off for going quiet, so it could stay paused and let a node’s send queue grow by up to 2MB an hour per inbound peer and 5MB an hour per outbound peer. That is 48MB and 120MB a day for each one. The third is rated low. A miner could corrupt the undo data nodes use to back out blocks, so they shut down after a precisely aimed short reorg. The advisory calls that “impractical” on 64-bit systems: it needs roughly a month of the whole network’s blocks. It also says “32-bit systems and nodes storing blocks on FAT32 remain affected.”

All three advisories say the bug “was discovered through an automated LLM scan,” Elias Rohrer’s Project Loupe at Spiral, and checked by Gregory Sanders before it went to the security team. Loupe flagged the undo bug on July 8, 112 days before disclosure, and the crash bug on October 23, five days before. People found two of the three on their own too: L0rinc reported the memory bug and the undo bug, and Andrew Dorman the undo bug. On October 23 this desk wrote that Core would publish easy-to-find bugs as soon as every maintained version had a fix. This is the first batch.

One detail does not fit the calendar. The project’s lifecycle page lists 29.x as end of life on October 27, 2026. On October 28 it shipped 29.5 anyway, with all three fixes, to the 41.78% of reachable Core nodes this desk counted on 29 or older. A second clock still runs. The 32.1 notes, dated October 27, promise to disclose “Medium and high severity vulnerabilities fixed in 30.0. There are 3 of these.” Two weeks from that date is November 10. Every fix is a public pull request you can read yourself. At the time of this writing, bitcoin was $80,972.