Start9 identifies the specific experimental Core Lightning feature to disable on StartOS: dual funding and liquidity ads

Start9 refers to a critical Core Lightning warning and gives StartOS users a specific protective step: disable the experimental “Dual funding and liquidity ads” feature. The message contains no released fix or confirmed exploitation.

Actions to take

If your Core Lightning node runs on StartOS, disable the feature right now: CLN > Actions & Config > Experimental Features > “Dual funding and liquidity ads” > disabled. The previous advice remains in effect: if you also have other experimental features enabled, disable them too without waiting for the review's conclusions. The Core Lightning warning is linked below.

Sources:

Incident history

15 SeptCore Lightning investigates reports of a possible issue in experimental features that may affect funds
15 SeptStart9 identifies the specific experimental Core Lightning feature to disable on StartOS: dual funding and liquidity ads
22 SeptCore Lightning releases 26.06.8 with vulnerability fixes; no embargo, update available immediately
02 OctCore Lightning reports receiving reports of attacks on unpatched nodes running 26.06.7 and earlier
07 OctCore Lightning releases 26.06.9: another set of security fixes and a fix for the gossip regression in 26.06.8
07 OctCore Lightning: 26.06.9 fixes a vulnerability that could lead to loss of funds
07 OctCore Lightning fix reaches BTCPay Server: bundled version now 26.06.9
07 OctCore Lightning fix reaches StartOS: update already available in Marketplace