Core Lightning ⚡️

The community Lightning Network implementation bringing instant, low-cost, global micropayments to Bitcoin.

[Core Lightning ⚡️ @Core_LN]

Core Lightning 26.06.9 is out. Upgrade now.

It fixes a newly reported vulnerability that can lead to loss of funds. Nodes running 26.06.8 or earlier are affected.

Verify the signatures and install it as soon as possible.

https://t.co/3Sj5Y8WX6F

[Core Lightning ⚡️ @Core_LN]

CLN users: older versions of the webpki-roots dependency (RUSTSEC-2026-0381) still trust compromised emSign intermediate certificates, which may expose HTTPS requests to potential MITM attacks.

Core CLN code and the Lightning protocol are unaffected. The vulnerability is limited to the currencyrate (cln-currencyrate) plugin, which is enabled by default. Exposure is possible when:

- Using commands provided by the currencyrate plugin
- Configuring bkpr-currency for the bookkeeper plugin

The BIP353 plugin is unaffected in practice. Its upstream dependency includes an LNURL fallback path that uses HTTPS, but CLN's BIP353 plugin relies on DNS resolution and ignores the LNURL fallback result, so the affected TLS certificate validation path is not used.

If you don't need currencyrate, disable it by adding this to your CLN configuration: disable-plugin=cln-currencyrate

A fix is pending the relevant upstream dependency updates and a subsequent CLN release. Nodes not using the affected currencyrate functionality are not expected to be exposed, even with the plugin enabled.

[Core Lightning ⚡️ @Core_LN]

Urgent security update: If you’re running version 26.06.7 or earlier, please upgrade to the latest release as soon as possible.

We’ve received reports that attackers are targeting unpatched nodes. Keeping your node up to date is an important step in protecting your funds.

[Core Lightning ⚡️ @Core_LN]

Core Lightning 26.06.8 is out, and every node runner should upgrade.

This release fixes vulnerabilities responsibly reported over recent weeks. There is no embargo period: the release and fixes are available right now.

A number of tests are being held back temporarily to make the underlying issues harder to reverse-engineer while node runners have time to upgrade.

Please upgrade as soon as possible.

https://t.co/WrFf07HFVx

[Core Lightning ⚡️ @Core_LN]

cln-application 26.09 is out.

It moves the app to Node 22, adds optional native HTTPS and reverse-proxy support, and tightens how passwords, sessions, and settings are handled. We recommend upgrading.

https://t.co/ff5LicNa5p

[Core Lightning ⚡️ @Core_LN]

Core Lightning 26.06.8 is out, and every node runner should upgrade.

This release fixes vulnerabilities responsibly reported over recent weeks. There is no embargo period: the release and fixes are available right now.

A number of tests are being held back temporarily to make the underlying issues harder to reverse-engineer while node runners have time to upgrade.

Please upgrade as soon as possible.

https://t.co/WrFf07HFVx

[Core Lightning ⚡️ @Core_LN]

Security Advisory: We are investigating reports of a potential issue affecting experimental features in Core Lightning that may impact user funds.

We urge all Core Lightning users running experimental features to disable them immediately while we investigate.

[Core Lightning ⚡️ @Core_LN]

Update: the 26.06.7 Docker image has been refreshed with the full security fix.

If you're running it via Docker, pull the latest tag now: https://t.co/9OegYMYW5u

[Core Lightning ⚡️ @Core_LN]

Core Lightning 26.06.7 is out and recommended for every node runner.

It fixes vulnerabilities reported over the past three weeks, during a sharp rise in AI-generated reports across open source Bitcoin. Details stay under embargo for two weeks, then all published.

https://t.co/Ygw1VkLkoV

[Core Lightning ⚡️ @Core_LN]

https://t.co/TYEBFRTZ9w

[Core Lightning ⚡️ @Core_LN]

https://t.co/LrsS9uvsVn

[Core Lightning ⚡️ @Core_LN]

Core Lightning 26.06.7 is out and recommended for every node runner.

It fixes vulnerabilities reported over the past three weeks, during a sharp rise in AI-generated reports across open source Bitcoin. Details stay under embargo for two weeks, then all published.

https://t.co/Ygw1VkLkoV

[Core Lightning ⚡️ @Core_LN]

https://t.co/LrsS9uvsVn

[Christian Decker @Snyke]

Well, seeing that our @Core_LN pre-announcement caused a bit of a kerfuffle, let me talk about the what, why, and when of the upcoming CLN v26.06.7 point release. 🧵

First of all: no need to panic. We are not aware of any vulnerability being actively exploited. 1/6

[Core Lightning ⚡️ @Core_LN]

To be clear about what we are recommending: you do not need to shut your node down.

Our advice is to upgrade. When the release lands, verify the signatures and install it, and do that promptly rather than eventually.

--offline is the alternative for anyone who is not going to upgrade. The flag closes peer connections, so nothing routes in, out or through you, while leaving the daemon up. That is why we suggest it over a shutdown: a live daemon still follows the chain and can respond if a counterparty force-closes, a stopped one cannot.

If you do run with --offline, take the flag back out once you upgrade or the node will stay disconnected.

[Core Lightning ⚡️ @Core_LN]

Core Lightning has been triaging a high volume of AI-generated CVE reports over recent weeks. Several are real, and a coordinated fix is underway.

What to do now: do not shut your node down. Restart it with --offline.

That flag stops peer connections, so no payments route in, out or through your node. It keeps running, which means it keeps watching the chain and can still act if a counterparty force-closes a channel. A node that is powered off cannot do that, and that is why switching off is the worse option.

On @umbrel or @start9labs this is a startup setting for Core Lightning, not a toggle in the dashboard.

What happens next: signed binaries will be published. Verify the signatures before you install, then bring your node back online. Source and reproducible builds follow afterwards so anyone can audit what changed.

https://t.co/FHzhgrPChn

[Core Lightning ⚡️ @Core_LN]

Core Lightning has been triaging a high volume of AI-generated CVE reports over recent weeks. Several are real, and a coordinated fix is underway.

What to do now: do not shut your node down. Restart it with --offline.

That flag stops peer connections, so no payments route in, out or through your node. It keeps running, which means it keeps watching the chain and can still act if a counterparty force-closes a channel. A node that is powered off cannot do that, and that is why switching off is the worse option.

On @umbrel or @start9labs this is a startup setting for Core Lightning, not a toggle in the dashboard.

What happens next: signed binaries will be published. Verify the signatures before you install, then bring your node back online. Source and reproducible builds follow afterwards so anyone can audit what changed.

https://t.co/FHzhgrPChn

[Core Lightning ⚡️ @Core_LN]

https://t.co/5U4U4lVpYT

[Christian Decker @Snyke]

@callebtc This gives users 14 days to upgrade after which they'll be able to verify the binaries thanks to our reprobuilds. If you chose to wait for the source release, only then do we suggest restarting with `--offline`. This keeps CLN enforcing on-chain rules, while shutting out attckrs

[Core Lightning ⚡️ @Core_LN]

If you run Core Lightning: when the release is published: upgrade with signed binaries, or start your node with `--offline`.

Details stay under embargo for two weeks. Previous releases, including 26.04, are unsupported.

Full details when the embargo lifts. The 26.09 release is still planned for late September.

[Core Lightning ⚡️ @Core_LN]

Like many open source Bitcoin projects, CLN has received a number of AI-generated CVE reports from multiple sources over the past 10 days. Our small team, together with several invaluable open source contributors, has been working intensively to validate and triage these reports and develop fixes where needed.

We’re now working through a broader remediation strategy. The first step is a point release containing many of these fixes, and we will strongly recommend upgrading. We’re aiming to have an initial version of the point release available within the next few days.

[Core Lightning ⚡️ @Core_LN]

@Blockstream Run a node, route payments, watch it work. One-click on @umbrel or @start9labs, or run it from source: https://t.co/UlQQwxJwt7

[Core Lightning ⚡️ @Core_LN]

The official Core Lightning app from @Blockstream is a dashboard you host yourself, connected straight to your own node.

Its Volume Chart maps routing traffic inbound to outbound, channel by channel, so you can see which channels earn their capital and which sit idle.

[bitcoin++ Insider Edition @btcinsider__]

In this week update by @TumaBitcoiner, we feature the current effort from the LDK team (@lightningdevkit) to add support for recurrent payments in BOLT12. We also discuss a new plugin for Core-lightning (@Core_LN) to rebalance channels in a node.

We also cover the most interesting news from the Bitcoin ecosystem. Notably, we talk about Iceberg, a new nested threshold MuSig2 signature scheme, that allows Lightning operators to thresholdize one participant inside a multi-signature protocol.

[Core Lightning ⚡️ @Core_LN]

Like many open source Bitcoin projects, CLN has received a number of AI-generated CVE reports from multiple sources over the past 10 days. Our small team, together with several invaluable open source contributors, has been working intensively to validate and triage these reports and develop fixes where needed.

We’re now working through a broader remediation strategy. The first step is a point release containing many of these fixes, and we will strongly recommend upgrading. We’re aiming to have an initial version of the point release available within the next few days.