Core Lightning fix reaches BTCPay Server: bundled version now 26.06.9

BTCPay Server has updated its bundled Core Lightning to 26.06.9, a release fixing a vulnerability that could cause loss of funds. The update is available to BTCPay users right now through the standard mechanism. If CLN is not used in your installation, the incident does not affect you.

Actions to take

If your BTCPay runs Core Lightning, update the installation now without waiting for a maintenance window: Server Settings → Maintenance → Update, or the standard BTCPay update script. Users without CLN do not need to do anything.

Source: x.com - BtcpayServer

Incident history

15 SeptCore Lightning investigates reports of a possible issue in experimental features that may affect funds
15 SeptStart9 identifies the specific experimental Core Lightning feature to disable on StartOS: dual funding and liquidity ads
22 SeptCore Lightning releases 26.06.8 with vulnerability fixes; no embargo, update available immediately
02 OctCore Lightning reports receiving reports of attacks on unpatched nodes running 26.06.7 and earlier
07 OctCore Lightning releases 26.06.9: another set of security fixes and a fix for the gossip regression in 26.06.8
07 OctCore Lightning: 26.06.9 fixes a vulnerability that could lead to loss of funds
07 OctCore Lightning fix reaches BTCPay Server: bundled version now 26.06.9
07 OctCore Lightning fix reaches StartOS: update already available in Marketplace