Core Lightning urges upgrade from 26.06.7 and earlier as attackers target unpatched nodes

Summary

On 2 October 2026 the Core Lightning team (@Core_LN) posted an urgent security update asking operators running version 26.06.7 or earlier to upgrade to the latest release, citing reports that attackers are targeting unpatched nodes (as quoted by Cointelegraph and TFTC). Core Lightning v26.06.8 (changelog dated 2026-09-19) fixes a set of remotely triggerable crash, resource-exhaustion and fund-loss bugs. A further point release, v26.06.9 (2026-10-06), fixes additional remote-crash, rune-restriction and splicing issues and is "recommended for all users".

Affected

• Core Lightning (ElementsProject/lightning) 26.06.7 and earlier
• Fixed in 26.06.8; 26.06.9 contains further fixes and is the current recommended release

Impact

Per the official CHANGELOG for 26.06.8, fixed issues include: - A peer receiving a payment could crash the sender's node by returning a crafted error onion. - clnrest: an unauthenticated YAML request using anchors/aliases could exhaust memory and crash the plugin; excessively nested XML could risk a stack overflow. - A unilateral close after a splice locked could broadcast a revoked commitment, losing the channel funds to a penalty. - A peer reusing an HTLC id or a funding outpoint could crash the node; several other crash and CPU-exhaustion paths. Per the 26.06.9 CHANGELOG, fixed issues include an unparseable incoming HTLC onion crashing the node in some cases, peer-triggered crashes via splice messages and splice RBF, rune restriction bypasses (createrune/blacklistrune via aliases, restricted runes creating unrestricted ones), config-line injection through setconfig, and a case where forwarded funds could be lost to a late fulfill during shutdown. The Core Lightning team states attackers are targeting unpatched nodes; it has not publicly named which vulnerabilities are being exploited, and no loss of funds has been confirmed by the team according to the reporting.

Recommended actions

• Upgrade Core Lightning nodes to 26.06.9 (at minimum 26.06.8) immediately.
• Do not expose the clnrest / wss-proxy interfaces to untrusted networks; review issued runes and their restrictions after upgrading.
• Monitor channels for unexpected force-closes and keep watchtower / backup arrangements current.

Source & attribution

This 0xCERT advisory summarises the Core Lightning team's security warning (https://x.com/Core_LN/status/2105835841847242976, as reported by Cointelegraph and TFTC) and the official Core Lightning CHANGELOG (https://github.com/ElementsProject/lightning/blob/master/CHANGELOG.md). The fixes are credited upstream to the Bitcoin Red Team and other named and anonymous reporters. Details may change; refer to the original sources for the authoritative record.