Madeline Paech

[Core Lightning ⚡️ @Core_LN]

Core Lightning 26.06.9 is out. Upgrade now.

It fixes a newly reported vulnerability that can lead to loss of funds. Nodes running 26.06.8 or earlier are affected.

Verify the signatures and install it as soon as possible.

https://t.co/3Sj5Y8WX6F

[Blockstream @Blockstream]

Core Lightning node runners, this is urgent, upgrade to 26.06.8 now if you haven't already.

[Core Lightning ⚡️ @Core_LN]

Urgent security update: If you’re running version 26.06.7 or earlier, please upgrade to the latest release as soon as possible.

We’ve received reports that attackers are targeting unpatched nodes. Keeping your node up to date is an important step in protecting your funds.

[Core Lightning ⚡️ @Core_LN]

cln-application 26.09 is out.

It moves the app to Node 22, adds optional native HTTPS and reverse-proxy support, and tightens how passwords, sessions, and settings are handled. We recommend upgrading.

https://t.co/ff5LicNa5p

[Core Lightning ⚡️ @Core_LN]

Core Lightning 26.06.8 is out, and every node runner should upgrade.

This release fixes vulnerabilities responsibly reported over recent weeks. There is no embargo period: the release and fixes are available right now.

A number of tests are being held back temporarily to make the underlying issues harder to reverse-engineer while node runners have time to upgrade.

Please upgrade as soon as possible.

https://t.co/WrFf07HFVx

[Core Lightning ⚡️ @Core_LN]

Security Advisory: We are investigating reports of a potential issue affecting experimental features in Core Lightning that may impact user funds.

We urge all Core Lightning users running experimental features to disable them immediately while we investigate.

[GitHub Projects Community @GithubProjects]

|￣￣￣￣￣￣￣￣￣￣￣|
| Don't Push |
| to Production |
| on Friday |
|＿＿＿＿＿＿＿＿＿＿＿|
(\___/) ||
(⌾ㅅ⌾) ||
/ 　 づ

[𝒵𝒾𝓀✯ @_Gottalovezik]

when you deliberately didn't buy snacks to avoid snacking at night, but now it's night & there's no snacks

[TheRustyTwit @rusty_twit]

Annoyed that the CLN message "when the upgrade drops as scheduled, upgrade or --offline" got mangled into "SHUT DOWN YOUR NODE NOW".

People don't read anymore.

[Core Lightning ⚡️ @Core_LN]

Update: the 26.06.7 Docker image has been refreshed with the full security fix.

If you're running it via Docker, pull the latest tag now: https://t.co/9OegYMYW5u

[Core Lightning ⚡️ @Core_LN]

https://t.co/LrsS9uvsVn

[Core Lightning ⚡️ @Core_LN]

Core Lightning 26.06.7 is out and recommended for every node runner.

It fixes vulnerabilities reported over the past three weeks, during a sharp rise in AI-generated reports across open source Bitcoin. Details stay under embargo for two weeks, then all published.

https://t.co/Ygw1VkLkoV

[Isabella M Weber @IsabellaMWeber]

AI will do to minds what the decline in manual labor did to bodies.

The privileged few will keep exercising their minds with literature, art and science, just like they kept exercising their bodies despite escalators, elevators and desk work.

The many will suffer something akin to the obesity crisis but for the mind.

[AMBOSS ⚡ @ambosstech]

Important clarification:
Don't shut down your CLN node.
Instead, upgrade when the update lands (after checking signatures)

[AMBOSS ⚡ @ambosstech]

We're seeing elevated lightning payments activity despite many CLN nodes being --offline pending a security update.

No exploits have been reported, so this means economic activity on LN is proceeding as usual.

[Core Lightning ⚡️ @Core_LN]

To be clear about what we are recommending: you do not need to shut your node down.

Our advice is to upgrade. When the release lands, verify the signatures and install it, and do that promptly rather than eventually.

--offline is the alternative for anyone who is not going to upgrade. The flag closes peer connections, so nothing routes in, out or through you, while leaving the daemon up. That is why we suggest it over a shutdown: a live daemon still follows the chain and can respond if a counterparty force-closes, a stopped one cannot.

If you do run with --offline, take the flag back out once you upgrade or the node will stay disconnected.

[Madeline Paech @madelinevibes]

@callebtc @callebtc are you planning to spark the same panic for the other lightning implementations or just CLN?

This is incorrect advice, we are not urging users to 'shut down nodes'

[Core Lightning ⚡️ @Core_LN]

Core Lightning has been triaging a high volume of AI-generated CVE reports over recent weeks. Several are real, and a coordinated fix is underway.

What to do now: do not shut your node down. Restart it with --offline.

That flag stops peer connections, so no payments route in, out or through your node. It keeps running, which means it keeps watching the chain and can still act if a counterparty force-closes a channel. A node that is powered off cannot do that, and that is why switching off is the worse option.

On @umbrel or @start9labs this is a startup setting for Core Lightning, not a toggle in the dashboard.

What happens next: signed binaries will be published. Verify the signatures before you install, then bring your node back online. Source and reproducible builds follow afterwards so anyone can audit what changed.

https://t.co/FHzhgrPChn

[Madeline Paech @madelinevibes]

If you run a cln node: upgrade when the signed fix binaries land, or take your node --offline until you do. Not a drill, not a panic.

Everyone is doing their best for the ecosystem (AI assisted, ofc) in this time of unprecedented chaos.

[Core Lightning ⚡️ @Core_LN]

If you run Core Lightning: when the release is published: upgrade with signed binaries, or start your node with `--offline`.

Details stay under embargo for two weeks. Previous releases, including 26.04, are unsupported.

Full details when the embargo lifts. The 26.09 release is still planned for late September.

[Blockstream_intern @blockstream_int]

🚨 Heads-up to all Core Lightning node operators: a critical security issue has been identified.

⚠️ CLN is asking operators to take their nodes offline immediately either with --offline or by shutting them down completely.

🛠️ A fix is being prepared, while technical details remain under embargo for now.

⏱️ No need to panic, but don’t delay: secure your node first and wait for the official update.