Core Lightning Urges Immediate Update Amid Active Exploitation Reports

The warning marks a significant escalation in a security cycle that began in August. Since that time, the project has navigated a surge in vulnerability reports, many of which were generated by AI models scanning open-source code. While the specific nature of the current attacks remains undisclosed, previous patches have addressed critical issues including node crashes, memory exhaustion, and potential fund losses during channel closures.

Version 26.06.8, released in late September, contained fixes for several of these flaws, developed in collaboration with the Bitcoin Red Team and independent security researchers. In previous instances, developers withheld specific test data to prevent attackers from reverse-engineering the patches, emphasizing that manual intervention is required to secure the network. Operators unable to update immediately were previously advised to utilize offline modes to monitor the blockchain without exposing their nodes to external peers, though the current situation demands a full software migration to mitigate ongoing risks.