Core Lightning has issued an urgent security alert to Bitcoin Lightning Network node operators, urging immediate upgrades after receiving reports of attackers targeting systems running version 26.06.7 or earlier. According to the Core Lightning team, operators using affected older releases should move to the latest version as soon as possible, following weeks after developers released another round of security fixes for the open source Lightning node software. The team stated 'Urgent security update: If you're running version 26.06.7 or earlier, please upgrade to the latest release as soon as possible,' without disclosing which vulnerabilities are being exploited or whether any reported attacks have resulted in lost funds.
Version 26.06.8, released on September 22, patched several security flaws that could have serious consequences for unpatched nodes. As reported by Core Lightning, the updates addressed bugs that could crash nodes, exhaust memory through the REST interface, or cause funds to be lost during channel closures. The release notes credited the Bitcoin Red Team alongside 12 named researchers and groups, as well as people who chose to report issues anonymously. According to the changelog, this round of fixes specifically addresses vulnerabilities that could cause sender nodes to crash, requests capable of exhausting REST interface memory, and a flaw that could result in penalty losses of user funds during channel closure. The September 16 discovery prompted the urgent response, with developers releasing the patch approximately six days later. However, the developers have not disclosed which specific flaw attackers are exploiting and are holding back some technical details to make it harder for other attackers to copy the exploits.
On Friday, the developers issued an urgent alert to users of the open-source Bitcoin Lightning Network node software after investigating a potential issue affecting experimental features that could impact user funds. Some test cases were withheld from public release to prevent attackers from exploiting freshly patched vulnerabilities during ongoing node operator upgrades. The September 22 release includes bug fixes and patches for vulnerabilities that the project says were responsibly reported by several sources. Core Lightning strongly recommended installing the release and said there was no embargo period for the update, though developers temporarily withheld a small number of tests from the public release to make it more difficult for prospective attackers to identify and reverse engineer the underlying vulnerabilities.
The Core Lightning warning reveals a clear distinction in risk exposure based on user type. For most Layer-2 Lightning users, the risk is less direct as only people who run their own Core Lightning node need to install the update themselves. Most people who use Lightning through a wallet app do not run a node, in which case the app provider usually handles the upgrade. Custodial wallets hold Bitcoin on behalf of their users, and if such a provider's node loses funds, the provider takes the first hit. Whether it repays users depends on its own terms, since Lightning has no deposit insurance. Users of self-custodial wallets, which let them hold their own keys, keep control of their channel balance but a crashed provider node could temporarily block their payments. This time, reports of attacks surfaced about 10 days after the patch shipped, highlighting the critical window between vulnerability discovery and patch deployment that operators must navigate.
The latest warning follows a series of security updates that Core Lightning developers have released since August. According to reports, the project confirmed multiple vulnerabilities in August after reviewing a large number of AI generated Common Vulnerabilities and Exposures reports. At that time, operators waiting for the security release were given the option of running Core Lightning with its offline setting, which disconnected nodes from Lightning peers and stopped payments while allowing the daemon to continue monitoring the Bitcoin blockchain. Version 26.06.7 was released on August 28 to address vulnerabilities identified during that work, with developers initially withholding its source code for two weeks to give operators time to update before prospective attackers could study the changes. The Core Lightning warning caps a rough stretch for Lightning security, following earlier attacks in August when attackers stole funds through a BTCPay Server vulnerability that exposed Lightning credentials, and as AI tools continue to speed up bug discovery, the window for Core Lightning operators who delay upgrades could shrink further.
