core lightning · Core Lightning (CLN)
Update to incident: Core Lightning investigates reports of a possible issue in experimental features that may affect funds
Core Lightning reports receiving reports of attacks on unpatched nodes running 26.06.7 and earlier
In its channel, the Core Lightning project says it has received reports of attackers targeting unpatched nodes. Installations running version 26.06.7 and earlier are affected; a fixed release is already available. For operators, this increases the urgency of the previously announced update: waiting now means an open attack surface against funds in channels.
Actions to take
If your node is still running 26.06.7 or earlier, update to the latest release today without waiting for a maintenance window; after updating, check channel status and balances. Details are at the link in the post.
Source: x.com - Core_LN
Incident history
- 15 SeptCore Lightning investigates reports of a possible issue in experimental features that may affect funds
- 15 SeptStart9 identifies the specific experimental Core Lightning feature to disable on StartOS: dual funding and liquidity ads
- 22 SeptCore Lightning releases 26.06.8 with vulnerability fixes; no embargo, update available immediately
- 02 OctCore Lightning reports receiving reports of attacks on unpatched nodes running 26.06.7 and earlier
- 07 OctCore Lightning releases 26.06.9: another set of security fixes and a fix for the gossip regression in 26.06.8
- 07 OctCore Lightning: 26.06.9 fixes a vulnerability that could lead to loss of funds
- 07 OctCore Lightning fix reaches BTCPay Server: bundled version now 26.06.9
- 07 OctCore Lightning fix reaches StartOS: update already available in Marketplace