Core Lightning urges Bitcoin node operators to upgrade after security threat

Traders Union
All News
Crypto
Core Lightning node upgrade alert

Highlights

Core Lightning urges all Bitcoin Lightning Network node operators using version 26.06.7 or earlier to upgrade immediately due to active attacks on unpatched nodes.
Version 26.06.8, released Sept. 22, includes bug fixes for node crashes, REST interface memory exhaustion, and a channel penalty bug risking user fund loss.
Some test cases were withheld from public release to prevent attackers from exploiting freshly patched vulnerabilities during ongoing node operator upgrades.

Security update and affected versions

As reported by Cointelegraph, the team behind Core Lightning says operators using version 26.06.7 or earlier need to move to the latest release as soon as possible after receiving reports of attacks against unpatched nodes. The project does not specify which vulnerabilities are being targeted or what the full impact could be.

On Friday, the developers issue an urgent alert to users of the open-source Bitcoin Lightning Network node software. Core Lightning had already said on Sept. 16 that it was investigating a potential issue affecting experimental features that could impact user funds, before releasing version 26.06.8 roughly six days later.

The Sept. 22 release includes bug fixes and patches for vulnerabilities that the project says were responsibly reported by several sources. Release notes credit the Bitcoin Red Team, 12 named individuals and groups, and anonymous reporters for identifying the issues.

Operational risks for Bitcoin infrastructure

According to the changelog, some fixes address flaws that could crash senders' nodes, malicious requests that could exhaust memory in the REST interface, and a channel-closing bug that could cause users to lose funds to a penalty. The project also withholds some tests from the public release to make it harder for attackers to reverse-engineer the vulnerabilities while node operators are still upgrading.

Core Lightning had already been dealing with security review pressure in August, when it said it was preparing a coordinated fix after assessing a high volume of AI-generated Common Vulnerabilities and Exposures, or CVE, reports in recent weeks. Two days later, it released version 26.06.7 to address the confirmed vulnerabilities.

Our earlier report on Africa Bitcoin Corp’s leadership upheaval outlined how the company’s chief investment officer resigned and a senior-linked adviser exited amid ongoing appeals against South Africa’s FSCA findings. The regulator alleged coordinated trading in the firm’s former listed entity, leading to long debarment orders and multi-million-rand penalties that remain under review at the Financial Services Tribunal.

This material may contain third-party opinions, none of the data and information on this webpage constitutes investment advice according to our Disclaimer. While we adhere to strict Editorial Integrity, this post may contain references to products from our partners.