Core Lightning investigates reports of a possible issue in experimental features that may affect funds

Core Lightning reports in its own security advisory that it is investigating reports of a possible issue in experimental features. According to the vendor, it may affect users' funds. The issue concerns nodes with experimental features enabled. The vendor has not yet disclosed technical details, affected versions or signs of exploitation; there is no fix.

Actions to take

If experimental features are enabled on your Core Lightning node, disable them immediately without waiting for the investigation's conclusions: this is the vendor's advice. Do not re-enable them until Core Lightning publishes its findings or a fix. Follow updates through the link below.

Source: x.com - Core_LN

Incident history

15 SeptCore Lightning investigates reports of a possible issue in experimental features that may affect funds
15 SeptStart9 identifies the specific experimental Core Lightning feature to disable on StartOS: dual funding and liquidity ads
22 SeptCore Lightning releases 26.06.8 with vulnerability fixes; no embargo, update available immediately
02 OctCore Lightning reports receiving reports of attacks on unpatched nodes running 26.06.7 and earlier
07 OctCore Lightning releases 26.06.9: another set of security fixes and a fix for the gossip regression in 26.06.8
07 OctCore Lightning: 26.06.9 fixes a vulnerability that could lead to loss of funds
07 OctCore Lightning fix reaches BTCPay Server: bundled version now 26.06.9
07 OctCore Lightning fix reaches StartOS: update already available in Marketplace