[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fbj9t0z-grrxT3tG_EDphU6VqKQeG0sNqxzIPIMy3TK4":3},{"article":4,"iocs":41,"watch_terms":52,"solutions":53,"lesson":143},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":25,"category":26,"article_tags":30},"86e44170-1ee7-4ebf-9632-5c76b8046aa7","CVE-2025-62861: Bitcoin Core Mining Bug and 2 More Flaws","cve-2025-62861-bitcoin-core-mining-bug-and-2-more-flaws-65385b","A reorg could corrupt the mempool on Bitcoin Core 28.0 to 29.1 and stop block templates until restart; fixes shipped in October 2025.","Bitcoin Core disclosed three security flaws patched in October 2025, including CVE-2025-62861, a high-severity bug causing mining nodes to fail block template creation after chain reorganization until restart. The flaw affects Bitcoin Core 28.0–28.2 and 29.0–29.1; during a reorg, the mempool could become corrupted when sibling eviction logic ran on restored transactions. Two additional medium-severity flaws were also disclosed: CVE-2025-62859 allowing malicious peers to stall block processing, and CVE-2025-62860 granting trusted-peer permissions to anonymous Tor connections on nodes with the -whitelist option.","Bitcoin Core patches high-severity mining bug CVE-2025-62861 affecting versions 28.0–29.1.","https:\u002F\u002Fwww.cyberkendra.com\u002F2026\u002F11\u002Fcve-2025-62861-bitcoin-core-mining-bug.html","https:\u002F\u002Fwww.cyberkendra.com\u002Fwp-content\u002Fuploads\u002F2026\u002F11\u002FBitcoin-Core-1024x683.webp","2026-11-11T15:42:00+00:00","2026-11-11T17:00:27.252647+00:00",8,[17,20,23],{"name":18,"type":19},"Bitcoin Core","product",{"name":21,"type":22},"TRUC transactions (BIP 431)","technology",{"name":24,"type":22},"Tor","80544778-fabb-4dcd-aa35-17492e5dcf4f",{"id":25,"icon":27,"name":28,"slug":29},null,"Vulnerabilities","vulnerabilities",[31,36],{"category":32},{"id":33,"icon":27,"name":34,"slug":35},"0493c7e9-989a-4692-b4e6-136f5ec09675","Cryptography","cryptography",{"category":37},{"id":38,"icon":27,"name":39,"slug":40},"ade75414-7914-4e23-a450-48b64546ee70","Open Source","open-source",[42,46,49],{"type":43,"value":44,"context":45},"cve","CVE-2025-62861","High-severity Bitcoin Core mempool corruption bug affecting versions 28.0–29.1",{"type":43,"value":47,"context":48},"CVE-2025-62859","Medium-severity Bitcoin Core compact blocks bug allowing peer stall attacks",{"type":43,"value":50,"context":51},"CVE-2025-62860","Medium-severity Bitcoin Core Tor peer whitelisting bug granting unintended trust",[18],{"controls":54,"vendors":142},[55,84,113],{"slug":56,"name":57,"problem":58,"products":59},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[60,68,76],{"vendor_slug":61,"vendor_name":62,"vendor_logo":63,"product_slug":64,"product_name":65,"url":66,"description":67},"holm-security","Holm Security","\u002Fvendor-logos\u002Fholm-security.png","holm-security-platform","Holm Security Platform","https:\u002F\u002Fwww.holmsecurity.com\u002F","Vulnerability scanning of systems, web applications, cloud and the external attack surface, plus phishing simulation.",{"vendor_slug":69,"vendor_name":70,"vendor_logo":71,"product_slug":72,"product_name":73,"url":74,"description":75},"qualys","Qualys","\u002Fvendor-logos\u002Fqualys.png","vmdr","Qualys VMDR","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fvulnerability-management-detection-response\u002F","Vulnerability management, detection and response with risk-based prioritisation.",{"vendor_slug":77,"vendor_name":78,"vendor_logo":79,"product_slug":80,"product_name":81,"url":82,"description":83},"rapid7","Rapid7","\u002Fvendor-logos\u002Frapid7.png","insightvm","Rapid7 Exposure Command (InsightVM)","https:\u002F\u002Fwww.rapid7.com\u002Fproducts\u002Finsightvm\u002F","Vulnerability scanning and risk-based prioritisation; InsightVM is now part of Exposure Command, alongside attack surface and cloud risk.",{"slug":85,"name":86,"problem":87,"products":88},"patch-management","Automated patch management","Known holes get closed in days, not months.",[89,97,105],{"vendor_slug":90,"vendor_name":91,"vendor_logo":92,"product_slug":93,"product_name":94,"url":95,"description":96},"ninjaone","NinjaOne","\u002Fvendor-logos\u002Fninjaone.png","ninjaone-patch-management","NinjaOne Patch Management","https:\u002F\u002Fwww.ninjaone.com\u002Fpatch-management\u002F","Automated patching of operating systems and third-party applications from the cloud.",{"vendor_slug":98,"vendor_name":99,"vendor_logo":100,"product_slug":101,"product_name":102,"url":103,"description":104},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","intune","Microsoft Intune","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fmicrosoft-intune","Device management for Windows, macOS, iOS and Android, including update rings and compliance policies.",{"vendor_slug":106,"vendor_name":107,"vendor_logo":108,"product_slug":109,"product_name":110,"url":111,"description":112},"manageengine","ManageEngine","\u002Fvendor-logos\u002Fmanageengine.png","patch-manager-plus","ManageEngine Patch Manager Plus","https:\u002F\u002Fwww.manageengine.com\u002Fpatch-management\u002F","Patch management for operating systems and third-party applications, on premises or in the cloud.",{"slug":114,"name":115,"problem":116,"products":117},"threat-intelligence","Threat intelligence","Attack campaigns reach your sector, suppliers or software before your team hears about them.",[118,126,134],{"vendor_slug":119,"vendor_name":120,"vendor_logo":121,"product_slug":122,"product_name":123,"url":124,"description":125},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-adversary-intelligence","Falcon Adversary Intelligence","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fthreat-intelligence\u002F","Threat intelligence on the adversaries CrowdStrike tracks, built into the Falcon platform to detect, disrupt and defend against them.",{"vendor_slug":127,"vendor_name":128,"vendor_logo":129,"product_slug":130,"product_name":131,"url":132,"description":133},"dataminr","Dataminr","\u002Fvendor-logos\u002Fdataminr.png","agentic-threat-intelligence-platform","Agentic Threat Intelligence Platform","https:\u002F\u002Fwww.dataminr.com\u002Fproducts\u002Fcyber-defense\u002Fagentic-threat-intelligence-platform\u002F","Threat intelligence platform, formerly ThreatConnect TI Ops, that collects, scores and structures intelligence and pushes it into security tools.",{"vendor_slug":135,"vendor_name":136,"vendor_logo":137,"product_slug":138,"product_name":139,"url":140,"description":141},"reliaquest","ReliaQuest","\u002Fvendor-logos\u002Freliaquest.png","greymatter-digital-risk-protection","GreyMatter Digital Risk Protection","https:\u002F\u002Freliaquest.com\u002Fsecurity-operations-platform\u002Fdark-web-and-digital-risk-protection\u002F","Watches the open, deep and dark web for threats aimed at an organisation and alerts its security team in real time.",[],{"slug":144,"title":145,"body":146,"framework_refs":147,"framework_notes":153},"bitcoin-core-flaws-highlight-risks-of-delayed-patching-in-critical-blockchain-infrastructure","Bitcoin Core Flaws Highlight Risks of Delayed Patching in Critical Blockchain Infrastructure","Three security vulnerabilities in Bitcoin Core—spanning versions 28.0 through 29.1—were patched in October 2025, with the most severe (CVE-2025-62861) capable of causing mining nodes to halt block template creation after a chain reorganization until manually restarted. The mempool corruption triggered by sibling eviction logic during reorgs represents a subtle but high-impact software defect that could disrupt mining operations and network stability. Additionally, CVE-2025-62860 exposed a misconfiguration risk where anonymous Tor connections could inadvertently inherit trusted-peer permissions via the -whitelist option. These flaws matter because Bitcoin infrastructure underpins significant financial value, and even brief disruptions to mining nodes or block propagation can have outsized economic and network-integrity consequences. Node operators running affected versions who delayed patching remained exposed to denial-of-service and privilege escalation scenarios during this window.",[148,149,150,151,152],"CIS Control 7: Continuous Vulnerability Management (v8)","CIS Control 4: Secure Configuration of Enterprise Assets and Software (v8)","NIST SP 800-53 SI-2: Flaw Remediation","NIS2 Article 21(2)(e)","NIST CSF 2.0 PR.PS-01: Configuration Management",{"NIS2 Article 21(2)(e)":154,"NIST SP 800-53 SI-2: Flaw Remediation":155,"NIST CSF 2.0 PR.PS-01: Configuration Management":156,"CIS Control 7: Continuous Vulnerability Management (v8)":157,"CIS Control 4: Secure Configuration of Enterprise Assets and Software (v8)":158},"This point covers vulnerability handling and disclosure in the acquisition, development, and maintenance of systems, directly applicable to the need for timely patching of known CVEs in critical network infrastructure like Bitcoin Core nodes.","SI-2 requires organizations to identify, report, and correct information system flaws in a timely manner, which is precisely the control gap exploited across all three Bitcoin Core CVEs during the period between disclosure and patching.","PR.PS-01 requires that configurations of assets are established and maintained, which would have caught the insecure `-whitelist` Tor permission misconfiguration described in CVE-2025-62860 before deployment.","CIS Control 7 requires organizations to continuously assess and remediate vulnerabilities; had node operators maintained a patching cadence aligned with vendor disclosures, the exposure window for all three CVEs would have been minimized.","CIS Control 4 requires secure, reviewed configurations for software; auditing the `-whitelist` option to prevent anonymous Tor peers from receiving trusted permissions directly addresses CVE-2025-62860."]