Your signal. Your price.
A volunteer Bitcoin red team used AI models to scan projects and reported thousands of findings. A privately reported BTCPay Server flaw was exploited on merchant servers, while Core Lightning told operators to disconnect after reports to its team proved real; David Bennett worries rushed fixes could introduce new bugs.
Bitcoin Core 32.0-rc3 has a testing guide and needs testers. Core Lightning 26.06.9 is a security release covering channel establishment, splicing, HTLC handling, and access control; BTCPay Server 2.4.5 blocks private-network webhook destinations by default and tightens invoice and refund permissions.
Core Lightning backported security and reliability fixes, including preventing a post-splice force close from publishing a revoked commitment and matching on-chain HTLCs by both script and amount. A make-secret flaw also let authorized callers derive the master secret and forge unrestricted RPC tokens.
Core Lightning released version 26.06.9 to fix a critical bug capable of causing user fund losses. The release follows version 26.06.8, which patched distinct fund-loss vulnerabilities weeks prior.
Core Lightning urged operators to upgrade to version 26.06.8 immediately to patch a critical vulnerability currently being actively exploited to drain node funds. Attackers route small key-send payments during channel splices to trigger false revocation sweeps on-chain.
Node runners running Core Lightning version 26.06.7 or earlier face potential exploits, with user Zezabul reporting eight suspicious channel closures and a potential loss of 0.2 BTC.
Core Lightning 26.06.8 acts as a security release that temporarily withholds certain tests to prevent attackers from finding vulnerabilities. PR 9507 caps peer-proposed fee rates at 4,000 sats per vB to prevent overflow bugs that crash restarting nodes.
Core Lightning fixed vulnerabilities where peers could trick nodes into ignoring force-closed revoked commitments by sending a decoy shutdown message. Other fixes address nodes losing splice signature memory across restarts and limit peers to three concurrent negotiations.
Core Lightning PRs 9510 and 9511 mitigate crash risks by capping JSON nesting to 256 levels and rejecting oversized DNS hostnames. PR 9513 now validates that Bolt 12 fetched invoice amounts do not exceed requested or offered parameters.
Core Lightning developers urged operators to disable the experimental dual-funded channel feature after attackers successfully drained node liquidity offline. The exploit allowed peers to open channels containing ten times the actual locked funds.
LND PR 11061 implements Schnorr signature verification for Bolt 12 offers. Core Lightning PRs 9434 and 9473 resolve critical crash bugs in the Askrene routing engine plugin related to loading and deleting routing biases.
Core Lightning maintainers issued a two week embargo on a critical vulnerability, releasing version 26.06.7 as closed source signed binaries. Q criticizes this precedent, arguing motivated attackers can easily reverse engineer binaries to target unpatched nodes anyway.
Core Lightning implemented a software embargo, releasing signed binaries while withholding source code to patch critical bugs found using AI. Devs advised node operators to run in offline watchtower mode until the source code could be audited.
Core Lightning patched critical vulnerabilities by releasing binaries while embargoing the source code for two weeks to prevent immediate exploitation. Steve criticizes this approach, arguing that withholding source code violates open-source trust and fails to stop AI-equipped attackers.
Core Lightning confirmed multiple software vulnerabilities and urged operators to restart their nodes with the offline flag. The offline command stops payments from routing while allowing the daemon to track the blockchain and handle potential channel force-closes.
Core Lightning introduced B-Watch, an experimental external plugin that offloads block polling and transaction filtering from the main lightning daemon. This abstraction reduces redundant blockchain storage and allows alternative tracking systems to monitor the blockchain.
Core Lightning, Eclair, and LND merged several critical stability fixes. These updates prevent daemon crashes from oversized HTLC payloads, eliminate channel force-closes caused by duplicate settlement messages, and mitigate out-of-memory vulnerabilities during network state synchronization.