TL;DR
- Core Lightning warned operators running version 26.06.7 or earlier to upgrade immediately after receiving reports that attackers are targeting unpatched nodes.
- Version 26.06.8 includes fixes for crashes, REST-interface memory exhaustion and a channel-closing issue that could expose users to fund loss through penalties.
- Core Lightning has not identified which vulnerabilities are being actively exploited, quantified affected nodes or disclosed confirmed losses, making prompt patching the clearest defensive action for operators.
Core Lightning has issued an urgent warning to node operators after receiving reports that attackers are targeting systems that have not installed patches. In an official alert, the project told anyone running version 26.06.7 or earlier to upgrade to the latest release. The warning affects software used on Bitcoin‘s Lightning Network. Core Lightning says unpatched nodes are now being targeted, turning an earlier vulnerability disclosure into an active operational concern.
Urgent security update: If you’re running version 26.06.7 or earlier, please upgrade to the latest release as soon as possible.
We’ve received reports that attackers are targeting unpatched nodes. Keeping your node up to date is an important step in protecting your funds. https://t.co/E9ggGJsIit
— Core Lightning ⚡️ (@Core_LN) October 2, 2026
Core Lightning Urges Operators to Move Beyond 26.06.7
The alert follows a security process that began in August, when Core Lightning disclosed that it had validated multiple vulnerabilities after reviewing vulnerability reports. Operators were initially advised to run nodes offline if they could not update. The project later released version 26.06.7, while a previous Core Lightning security warning documented the shutdown guidance. The latest notice raises the urgency because the team is no longer warning only about theoretical exposure.
Core Lightning subsequently released version 26.06.8 on September 22 with bug fixes and patches for reported vulnerabilities. The fixes included issues capable of crashing sender nodes, exhausting memory through the REST interface and, in one channel-closing scenario, exposing users to a penalty that could cause loss of funds. Those fixes demonstrate the range of risks addressed by the update, but Core Lightning has not identified which specific vulnerabilities attackers are currently targeting. That distinction prevents the active attacks from being attributed to a particular flaw without confirmation.
The project temporarily withheld some tests associated with the fixes to make reverse engineering more difficult and give operators time to update. That approach reflected the tension between open-source disclosure and limiting an attacker’s ability to weaponize patches before adoption spreads. The episode adds a security dimension to a network used for Bitcoin Lightning payments and machine-payment systems. Once vulnerability details become easier to inspect, delayed upgrades can leave older nodes increasingly exposed.
For operators, the recommendation is straightforward: systems on version 26.06.7 or earlier should move to the latest release as soon as possible. The warning does not quantify how many nodes have been attacked, identify victims or disclose confirmed losses from the reported targeting. The known fact is that Core Lightning has received reports of attacks against unpatched nodes and is urging immediate upgrades. As Lightning expands into automated payment infrastructure, keeping node software current remains a basic operational requirement.
