Security update for the Core Lightning application on Umbrel

Umbrel is releasing an update to its Core Lightning application in response to a discovered security issue. Following the Core Lightning developers' recommendation, the node continues to run and monitor the Bitcoin network but temporarily disconnects from the Lightning network until a separate signed release containing the fix itself becomes available.

Actions to take

Install the Core Lightning application update on Umbrel now; the node will remain disconnected from Lightning until the signed release containing the fix becomes available — watch for a separate announcement of that release.

Source: x.com - nmfretz

Incident history

26 AugStart9 demands urgent Core Lightning update on StartOS
26 AugBTCPay Server disables routes through CLN and Eclair by default
27 AugSecurity update for the Core Lightning application on Umbrel
27 AugCore Lightning: update urgently once the release is out; use --offline mode until then
28 AugCore Lightning releases v26.06.7 with fixes for several vulnerabilities; source code under embargo
28 AugCore Lightning 26.06.7 fixes confirmed vulnerabilities; source code to be published later
29 AugBTCPay Server updates Core Lightning to v26.06.7 and keeps external CLN access disabled
01 SeptCore Lightning Docker images did not contain the advertised fix — StartOS switches to builds from signed tarballs
02 SeptCore Lightning 26.06.7 Docker image rebuilt with the full fix
08 SeptBTCPay Server 2.4.4: emergency update amid ongoing attacks on the project