Overview
- Bitcoin Core maintainers merged the policy change on October 22, 2026, creating a new disclosure route for vulnerabilities judged easy to rediscover.
- The new “easily discoverable” label covers flaws that can be found with minimal effort, including those a simple prompt to a large language model can surface.
- For bugs placed in that category developers will backport fixes to every actively supported major version and ship point releases at the same time as a security advisory.
- Maintainers warned this speeds fixes but reduces testing or "bake time," and some developers pushed to sometimes ship fixes without publishing full details.
- The change follows summer AI-driven audits and real exploits that exposed limits of long embargoes and the policy’s first real use will test how quickly point releases reach users.