BTCPay Server updates Core Lightning to v26.06.7 and keeps external CLN access disabled

BTCPay Server reports that it has updated Core Lightning to v26.06.7 in its Docker deployment, while external CLN access remains disabled as a precaution — it is planned to be enabled within one to two weeks. This affects BTCPay Server operators using Core Lightning in a Docker deployment. It separately notes that ARM32 devices, including some older Raspberry Pi models, may not work — ARM32 binaries were not built for this CLN release.

Actions to take

Update BTCPay Server through Server Settings → Maintenance → Update or the update command in the console; note that external CLN access is temporarily disabled and will return later.

Source: x.com - BtcpayServer

Incident history

26 AugStart9 demands urgent Core Lightning update on StartOS
26 AugBTCPay Server disables routes through CLN and Eclair by default
27 AugSecurity update for the Core Lightning application on Umbrel
27 AugCore Lightning: update urgently once the release is out; use --offline mode until then
28 AugCore Lightning releases v26.06.7 with fixes for several vulnerabilities; source code under embargo
28 AugCore Lightning 26.06.7 fixes confirmed vulnerabilities; source code to be published later
29 AugBTCPay Server updates Core Lightning to v26.06.7 and keeps external CLN access disabled
01 SeptCore Lightning Docker images did not contain the advertised fix — StartOS switches to builds from signed tarballs
02 SeptCore Lightning 26.06.7 Docker image rebuilt with the full fix
08 SeptBTCPay Server 2.4.4: emergency update amid ongoing attacks on the project