Update to incident: Start9 demands urgent Core Lightning update on StartOS
Core Lightning 26.06.7 fixes confirmed vulnerabilities; source code to be published later
Blockstream has released Core Lightning 26.06.7, a point release fixing vulnerabilities reported by independent researchers through the responsible disclosure program. The vendor will publish the fix's source code only after two weeks to make it harder to analyze the vulnerabilities before nodes are widely updated; only signed binaries are currently available. The vendor recommends a temporary workaround for those who cannot update immediately.
Update your Core Lightning node to version 26.06.7, verifying binary signatures before installation. If you cannot update right now, restart the daemon with the --offline flag to cut off incoming messages to the node until the update.
Source: blog.blockstream.com
Incident history
- 26 AugStart9 demands urgent Core Lightning update on StartOS
- 26 AugBTCPay Server disables routes through CLN and Eclair by default
- 27 AugSecurity update for the Core Lightning application on Umbrel
- 27 AugCore Lightning: update urgently once the release is out; use --offline mode until then
- 28 AugCore Lightning releases v26.06.7 with fixes for several vulnerabilities; source code under embargo
- 28 AugCore Lightning 26.06.7 fixes confirmed vulnerabilities; source code to be published later
- 29 AugBTCPay Server updates Core Lightning to v26.06.7 and keeps external CLN access disabled
- 01 SeptCore Lightning Docker images did not contain the advertised fix — StartOS switches to builds from signed tarballs
- 02 SeptCore Lightning 26.06.7 Docker image rebuilt with the full fix
- 08 SeptBTCPay Server 2.4.4: emergency update amid ongoing attacks on the project