Core Lightning releases 26.06.8 with vulnerability fixes; no embargo, update available immediately

Point release 26.06.8 fixes a set of vulnerabilities reported by external researchers; unlike 26.06.7, there is no embargo period, and the fixes are available immediately. The project has temporarily withheld some tests to make it harder to quickly reconstruct vulnerability details and attack before operators have time to update, so the window before technical details emerge is limited. It also notes that nodes running builds from master cannot downgrade to the 26.06.x branch because of a newer database schema.

Actions to take

Update your Core Lightning node to 26.06.8 now without delay: vulnerability details will become public soon. Dual funding remains experimental, and zero-conf channels with untrusted peers are still not recommended. If your node was running a master build, plan an upgrade path forward rather than a downgrade to 26.06.x.

Source: github.com

Incident history

15 SeptCore Lightning investigates reports of a possible issue in experimental features that may affect funds
15 SeptStart9 identifies the specific experimental Core Lightning feature to disable on StartOS: dual funding and liquidity ads
22 SeptCore Lightning releases 26.06.8 with vulnerability fixes; no embargo, update available immediately
02 OctCore Lightning reports receiving reports of attacks on unpatched nodes running 26.06.7 and earlier
07 OctCore Lightning releases 26.06.9: another set of security fixes and a fix for the gossip regression in 26.06.8
07 OctCore Lightning: 26.06.9 fixes a vulnerability that could lead to loss of funds
07 OctCore Lightning fix reaches BTCPay Server: bundled version now 26.06.9
07 OctCore Lightning fix reaches StartOS: update already available in Marketplace