Core Lightning: update urgently once the release is out; use --offline mode until then

Core Lightning's official account has addressed node operators: there is no need to stop the node now, but once the upcoming release is out, updating is mandatory and must not be delayed. Those unable to update immediately are advised to run the node with the --offline flag.

Actions to take

As soon as the release is out, verify the signatures and install it without delay. Until you update, start the node with the --offline flag.

Source: x.com - Core_LN

Incident history

26 AugStart9 demands urgent Core Lightning update on StartOS
26 AugBTCPay Server disables routes through CLN and Eclair by default
27 AugSecurity update for the Core Lightning application on Umbrel
27 AugCore Lightning: update urgently once the release is out; use --offline mode until then
28 AugCore Lightning releases v26.06.7 with fixes for several vulnerabilities; source code under embargo
28 AugCore Lightning 26.06.7 fixes confirmed vulnerabilities; source code to be published later
29 AugBTCPay Server updates Core Lightning to v26.06.7 and keeps external CLN access disabled
01 SeptCore Lightning Docker images did not contain the advertised fix — StartOS switches to builds from signed tarballs
02 SeptCore Lightning 26.06.7 Docker image rebuilt with the full fix
08 SeptBTCPay Server 2.4.4: emergency update amid ongoing attacks on the project