Core Lightning: 26.06.9 fixes a vulnerability that could lead to loss of funds

The project has clarified the urgency of release 26.06.9 on its channel: it fixes a newly reported vulnerability that could lead to loss of funds. Nodes on 26.06.8 and earlier are affected. This is stronger than the earlier wording about a “set of security fixes.”

Actions to take

Update to 26.06.9 immediately, without waiting for a maintenance window, and verify the release signatures before installation — links are below.

Sources:

Incident history

15 SeptCore Lightning investigates reports of a possible issue in experimental features that may affect funds
15 SeptStart9 identifies the specific experimental Core Lightning feature to disable on StartOS: dual funding and liquidity ads
22 SeptCore Lightning releases 26.06.8 with vulnerability fixes; no embargo, update available immediately
02 OctCore Lightning reports receiving reports of attacks on unpatched nodes running 26.06.7 and earlier
07 OctCore Lightning releases 26.06.9: another set of security fixes and a fix for the gossip regression in 26.06.8
07 OctCore Lightning: 26.06.9 fixes a vulnerability that could lead to loss of funds
07 OctCore Lightning fix reaches BTCPay Server: bundled version now 26.06.9
07 OctCore Lightning fix reaches StartOS: update already available in Marketplace