Core Lightning: Security Update Now Available

Maintainers of the Core Lightning software (formerly C-Lightning) released an emergency update yesterday patching vulnerabilities discovered over the past three weeks. "In early August, Core Lightning began receiving security reports from the open-source Bitcoin community. Our team, along with other contributors, immediately took action [...] The article Core Lightning: Security Update Now Available appeared first on bitcoin.fr.

The Lightning Network, a flagship layer-two solution designed to streamline Bitcoin transactions, is navigating a critical adjustment phase following the unannounced deployment of a security patch for the Core Lightning software. Alerted in early August through preemptive reports from the open-source developer community, the maintenance team orchestrated a rapid response to eliminate several recently identified vulnerabilities. This emergency intervention aims to safeguard network nodes against potential compromise and preserve the financial integrity of the affected payment channels.

To contain the threat without providing actionable leads to hackers, the project leads adopted a rigorous deployment protocol. The 26.06.7 patch version was made immediately available exclusively as signed binaries. The full publication of the source code has been intentionally withheld until September 11, providing a necessary buffer for node operators to update their systems. Once that date passes and the code is unveiled, it will be incumbent upon administrators to recompile the software from source to validate strict compliance with the installed executables.

Given the urgency of the situation, maintainers have issued clear instructions for infrastructure unable to switch instantly to the new version. It is strongly advised to restart the system using the --offline parameter. This stopgap measure neutralizes the attack vector by blocking remote communications that could contain malicious messages. However, experts reiterate that nodes should not be shut down entirely: keeping the background process running in offline mode remains essential to continue monitoring the Bitcoin blockchain and thwarting fraudulent attempts on channels.

This episode highlights the strict maintenance demands placed on participants in the decentralized ecosystem. By declaring all versions prior to 26.06.7 immediately obsolete, the technical team is compelling the entire network to adopt this priority upgrade to avoid prolonged vulnerability. This targeted incident management does not, however, appear to affect the project’s long-term roadmap, with the major 26.09 update remaining officially confirmed for the end of September.