sec_₿sec.21ideas.org
btcpay server · BTCPay Server
Exploitation confirmedPatch availableMerchants and infrastructure8 September 2026

Update to incident: Start9 demands urgent Core Lightning update on StartOS

BTCPay Server 2.4.4: emergency update amid ongoing attacks on the project

BTCPay Server has released version 2.4.4 — a security-focused update issued in response to ongoing attempts to attack the project. The vendor recommends on its own account that all server administrators update. Some changes are breaking — read the accompanying article before updating.

Actions to take

Update BTCPay Server to version 2.4.4; before updating, read the article describing the breaking changes — linked below.

Sources:

Incident history

  1. 26 AugStart9 demands urgent Core Lightning update on StartOS
  2. 26 AugBTCPay Server disables routes through CLN and Eclair by default
  3. 27 AugSecurity update for the Core Lightning application on Umbrel
  4. 27 AugCore Lightning: update urgently once the release is out; use --offline mode until then
  5. 28 AugCore Lightning releases v26.06.7 with fixes for several vulnerabilities; source code under embargo
  6. 28 AugCore Lightning 26.06.7 fixes confirmed vulnerabilities; source code to be published later
  7. 29 AugBTCPay Server updates Core Lightning to v26.06.7 and keeps external CLN access disabled
  8. 01 SeptCore Lightning Docker images did not contain the advertised fix — StartOS switches to builds from signed tarballs
  9. 02 SeptCore Lightning 26.06.7 Docker image rebuilt with the full fix
  10. 08 SeptBTCPay Server 2.4.4: emergency update amid ongoing attacks on the project