-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 0xCERT Security Advisory 0xCERT-2026-0234 ============================================================ Advisory-ID: 0xCERT-2026-0234 Severity: Critical Published: 2026-10-02T01:42:43.000Z Updated: 2026-10-11T00:39:53.636Z Chains: Bitcoin URL: https://www.0xcert.com/advisory/0xCERT-2026-0234 Title: Core Lightning urges upgrade from 26.06.7 and earlier as attackers target unpatched nodes Summary - ------- Core Lightning says attackers are targeting nodes running 26.06.7 or earlier. Releases 26.06.8 and 26.06.9 fix remote node crashes, unauthenticated clnrest memory exhaustion, rune restriction bypasses and fund-loss bugs. Upgrade Lightning nodes to 26.06.9 now. Details - ------- Summary On 2 October 2026 the Core Lightning team (@Core_LN) posted an urgent security update asking operators running version 26.06.7 or earlier to upgrade to the latest release, citing reports that attackers are targeting unpatched nodes (as quoted by Cointelegraph and TFTC). Core Lightning v26.06.8 (changelog dated 2026-09-19) fixes a set of remotely triggerable crash, resource-exhaustion and fund-loss bugs. A further point release, v26.06.9 (2026-10-06), fixes additional remote-crash, rune-restriction and splicing issues and is "recommended for all users". Affected - - Core Lightning (ElementsProject/lightning) 26.06.7 and earlier - - Fixed in 26.06.8; 26.06.9 contains further fixes and is the current recommended release Impact Per the official CHANGELOG for 26.06.8, fixed issues include: - - A peer receiving a payment could crash the sender's node by returning a crafted error onion. - - clnrest: an unauthenticated YAML request using anchors/aliases could exhaust memory and crash the plugin; excessively nested XML could risk a stack overflow. - - A unilateral close after a splice locked could broadcast a revoked commitment, losing the channel funds to a penalty. - - A peer reusing an HTLC id or a funding outpoint could crash the node; several other crash and CPU-exhaustion paths. Per the 26.06.9 CHANGELOG, fixed issues include an unparseable incoming HTLC onion crashing the node in some cases, peer-triggered crashes via splice messages and splice RBF, rune restriction bypasses (createrune/blacklistrune via aliases, restricted runes creating unrestricted ones), config-line injection through setconfig, and a case where forwarded funds could be lost to a late fulfill during shutdown. The Core Lightning team states attackers are targeting unpatched nodes; it has not publicly named which vulnerabilities are being exploited, and no loss of funds has been confirmed by the team according to the reporting. Recommended actions - - Upgrade Core Lightning nodes to 26.06.9 (at minimum 26.06.8) immediately. - - Do not expose the clnrest / wss-proxy interfaces to untrusted networks; review issued runes and their restrictions after upgrading. - - Monitor channels for unexpected force-closes and keep watchtower / backup arrangements current. Source & attribution This 0xCERT advisory summarises the Core Lightning team's security warning (https://x.com/Core_LN/status/2105835841847242976, as reported by Cointelegraph and TFTC) and the official Core Lightning CHANGELOG (https://github.com/ElementsProject/lightning/blob/master/CHANGELOG.md). The fixes are credited upstream to the Bitcoin Red Team and other named and anonymous reporters. Details may change; refer to the original sources for the authoritative record. References - ---------- - - https://x.com/Core_LN/status/2105835841847242976 - - https://github.com/ElementsProject/lightning/blob/master/CHANGELOG.md - - https://github.com/ElementsProject/lightning/releases/tag/v26.06.8 - - https://github.com/ElementsProject/lightning/releases/tag/v26.06.9 - - https://cointelegraph.com/news/core-lightning-urges-upgrade-amid-reports-attackers-targeting-unpatched-nodes - - https://www.tftc.io/core-lightning-active-attack-warning-upgrade-v26-06-8 Verify with the 0xCERT OpenPGP key: https://www.0xcert.com/pgp.asc Fingerprint: 5F94 3ED1 1E50 CF31 2128 C493 CCC7 D9EC 9415 723D -----BEGIN PGP SIGNATURE----- wrsEARYKAG0FgmroJfIJEDe9Tbcr+ZxrRRQAAAAAABwAIHNhbHRAbm90YXRp b25zLm9wZW5wZ3Bqcy5vcmcfpd5N9KxW2CLhGGSfn4rD5/Kt4M4LMW48+TZU H8RibRYhBGCkkFZbJcT5QWu27ze9Tbcr+ZxrAADN+QEAtTVsDfxKz7k6camv YjXdZtSHyHrMthv9MlrJyjtcauYBALCqFvSV6ia0s/wUIOjN1fMxg+0vGV8h L0WRzrG3MvcG =vIo5 -----END PGP SIGNATURE-----