The development team behind Core Lightning, an open-source software for the Bitcoin Lightning Network, has issued an urgent security advisory. Operators running version 26.06.7 or earlier are advised to update their systems immediately to the latest release.
The advisory follows reports that attackers are actively targeting unpatched nodes. While Core Lightning has not disclosed specific details regarding the nature of the vulnerabilities or the potential impact on users, the team emphasized the necessity of the update.
The current security measures follow an investigation initiated on September 16 into issues affecting experimental features that could threaten user funds. Consequently, version 26.06.8 was released on September 22, incorporating patches for multiple vulnerabilities.
The changelog for the latest version includes fixes for flaws that could crash nodes, memory exhaustion issues in the REST interface, and a bug in channel closing that risked fund loss. Some tests were withheld from the release to prevent reverse-engineering.
In August, the team reported that it was addressing a high volume of AI-generated vulnerability reports. The recent patches were developed in coordination with the Bitcoin Red Team, 12 identified contributors, and several anonymous security researchers.
