Core Lightning, a primary software client for the Bitcoin Lightning Network, has issued a security warning regarding nodes running version 26.06.7 or earlier. Developers report that attackers are actively targeting these unpatched nodes, potentially putting funds held in payment channels at risk.
The security update, version 26.06.8, was released on September 22. While the team has not disclosed specific technical details of the exploited flaws to prevent further attacks, the changelog notes several bugs that could lead to financial losses, node crashes, or unauthorized fund transfers during channel closures.
The vulnerability primarily affects individuals who operate their own Core Lightning nodes. Users of custodial wallet applications generally do not need to take action, as service providers typically manage updates. However, custodial providers bear the risk of fund loss, as the Lightning Network lacks deposit insurance.
This incident follows a series of security challenges for the network, including a BTCPay Server vulnerability in August that led to fund theft. Developers warn that as bug discovery accelerates, the window for operators to apply patches before exploitation occurs is shrinking significantly.
