Your signal. Your price.
A volunteer Bitcoin red team used AI models to scan projects and reported thousands of findings. A privately reported BTCPay Server flaw was exploited on merchant servers, while Core Lightning told operators to disconnect after reports to its team proved real; David Bennett worries rushed fixes could introduce new bugs.
Bitcoin Core 32.0-rc3 has a testing guide and needs testers. Core Lightning 26.06.9 is a security release covering channel establishment, splicing, HTLC handling, and access control; BTCPay Server 2.4.5 blocks private-network webhook destinations by default and tightens invoice and refund permissions.
Core Lightning backported security and reliability fixes, including preventing a post-splice force close from publishing a revoked commitment and matching on-chain HTLCs by both script and amount. A make-secret flaw also let authorized callers derive the master secret and forge unrestricted RPC tokens.
Core Lightning released version 26.06.9 to fix a critical bug capable of causing user fund losses. The release follows version 26.06.8, which patched distinct fund-loss vulnerabilities weeks prior.
Core Lightning urged operators to upgrade to version 26.06.8 immediately to patch a critical vulnerability currently being actively exploited to drain node funds. Attackers route small key-send payments during channel splices to trigger false revocation sweeps on-chain.