Core Lightning operators running version 26.06.7 or earlier are being actively targeted by attackers, according to an alert issued by the Bitcoin Lightning Network node software project. The warning comes roughly 10 days after a security patch was released to address multiple vulnerabilities.
Maintainers have not yet identified precisely which vulnerabilities the attackers are exploiting, and there are no confirmed reports of stolen funds. However, version 26.06.8 was released on September 22 to fix several security problems, including a channel-closing defect capable of putting user funds at risk.
Details of the Patches and Vulnerabilities
Public descriptions of the software release point to three classes of bugs. One bug could crash a sender’s node, while another could exhaust memory through the Core Lightning REST interface. The most severe issue involves channel closing, where a defect could cause Core Lightning to mistake certain transactions for an ordinary cooperative close and miss a revoked commitment.
In this scenario, the software's punishment system—designed to allow an honest participant to claim funds if a peer broadcasts an obsolete channel state—could fail. This leaves funds vulnerable that should otherwise be forfeited. The project has not specified which of these specific flaws the attackers are targeting.
Maintainers emphasized that this issue affects Core Lightning, a specific implementation of the Lightning Network scaling solution, and is not a vulnerability in Bitcoin itself. Other implementations such as LND, Eclair, and LDK were not named in the advisory.
Background and Recommendations
The recent security cycle began in late August when Core Lightning disclosed it was sorting through a batch of vulnerability reports, several of which proved legitimate. Because Lightning nodes must keep channel keys online to route payments in real time, outdated software presents a significant risk to active funds.
Crypto firm Blockstream amplified the warning, urging node operators to upgrade immediately. Operators still running version 26.06.7 or earlier are instructed to install version 26.06.8 or later, verify signatures or Docker digests, and keep experimental features disabled unless they fully understand the risks.
