Core Lightning · Start9 / StartOS
Update to incident: Start9 demands urgent Core Lightning update on StartOS
Core Lightning Docker images did not contain the advertised fix — StartOS switches to builds from signed tarballs
The vendor reports that the release's Docker images, published on August 28, did not actually include the announced security fixes — this became known only now, through a quiet edit to the release page without a separate announcement. This means operators who updated through Docker (including through BTCPay Server) remained all this time…
Actions to take
Operators who deployed Core Lightning through Docker should urgently update to version 26.6.7:2, built from signed tarballs, rather than relying on the previous Docker image.
Incident history
- 26 AugStart9 demands urgent Core Lightning update on StartOS
- 26 AugBTCPay Server disables routes through CLN and Eclair by default
- 27 AugSecurity update for the Core Lightning application on Umbrel
- 27 AugCore Lightning: update urgently once the release is out; use --offline mode until then
- 28 AugCore Lightning releases v26.06.7 with fixes for several vulnerabilities; source code under embargo
- 28 AugCore Lightning 26.06.7 fixes confirmed vulnerabilities; source code to be published later
- 29 AugBTCPay Server updates Core Lightning to v26.06.7 and keeps external CLN access disabled
- 01 SeptCore Lightning Docker images did not contain the advertised fix — StartOS switches to builds from signed tarballs
- 02 SeptCore Lightning 26.06.7 Docker image rebuilt with the full fix
- 08 SeptBTCPay Server 2.4.4: emergency update amid ongoing attacks on the project