In brief
- The Core Lightning team told node runners on version 26.06.7 or earlier to upgrade at once, citing reports that attackers are targeting unpatched nodes.
- The fix is release 26.06.8, published on GitHub on Sept. 22 with patches for flaws that could crash nodes or, in one splice case, lose channel funds.
- The team has not said which bug is being exploited or whether any funds have been lost.
The developers of Core Lightning, one of the main node programs for Bitcoin’s Lightning Network, told operators on Oct. 2 to upgrade immediately. “If you’re running version 26.06.7 or earlier, please upgrade to the latest release as soon as possible,” the project wrote on X, adding that it had “received reports that attackers are targeting unpatched nodes.”
Blockstream, whose engineers maintain much of the project, repeated the call minutes later and named 26.06.8 as the version to run.
What does 26.06.8 fix?
The 26.06.8 release went out on Sept. 22 with “fixes for vulnerabilities responsibly reported by a number of sources,” including the Bitcoin Red Team and a dozen named researchers. Unlike the previous patch, it had no embargo. The team instead held back a few tests to make the bugs harder to reverse-engineer while people upgrade.
The changelog lists 47 fixes. Several read like attack paths. A peer receiving a payment could crash the sender’s node with a crafted error onion. An unauthenticated YAML request to the clnrest plugin could exhaust memory. A peer reusing an already-resolved HTLC id could crash the node. The most serious entry concerns splicing: a unilateral close after a splice locked “could broadcast a revoked commitment, losing the channel funds to a penalty.”
Which of these, if any, the attackers are using is not public. Crashes matter on Lightning even without direct theft, because a node that is offline cannot watch the chain for a peer broadcasting an old channel state.
How did it get here?
Core Lightning shipped version 26.06.7 on Aug. 28 as binaries only, keeping the source under a 14-day embargo that ended on Sept. 11. Its notes said AI models were driving up “the volume and pace of security reports” against open-source code. The project also disclosed that from Aug. 28 to Sept. 1 its Docker tags for 26.06.7 served images that did not contain the fixes, so anyone who pulled them then should check the image digest. Those operators now need 26.06.8 anyway.
For operators, the lesson is that running a Lightning node means running live, internet-facing software that holds funds, and it has to be kept current. Our guide to how crypto hacks happen covers the most common ways attackers get in.
What to watch next is a post-mortem from the Core Lightning team naming the exploited flaw, CVE identifiers for the 26.06.8 fixes, and any report of lost funds. None had been published at the time of writing.
