SKN | Core Lightning Warns Attackers Are Targeting Unpatched Bitcoin Nodes

Key Points

• Core Lightning urged operators running version 26.06.7 or earlier to upgrade immediately after receiving reports of attacks targeting unpatched nodes.
• Version 26.06.8 introduced fixes for multiple vulnerabilities, including issues that could crash nodes, exhaust memory and potentially cause users to lose funds.
• Core Lightning previously withheld some security tests from its release notes to make it more difficult for attackers to reverse-engineer the vulnerabilities while operators upgraded.

The Core Lightning development team has issued an urgent security warning to Bitcoin Lightning Network node operators after receiving reports that attackers are actively targeting nodes running outdated versions of its software.

Operators using Core Lightning version 26.06.7 or earlier were advised to upgrade to the latest release as soon as possible. The team has not disclosed which specific vulnerabilities are being targeted or how many nodes may have been affected.

The warning adds urgency to a series of security updates Core Lightning has issued since August as developers have investigated vulnerabilities affecting the open-source Lightning Network implementation.

Core Lightning Releases Emergency Security Fixes

On Sept. 16, Core Lightning said it was investigating reports of a potential issue involving experimental features that could potentially affect user funds. The team subsequently released version 26.06.8 approximately six days later.

The Sept. 22 release included general bug fixes as well as patches for vulnerabilities that had been responsibly disclosed by multiple security researchers and groups.

The release notes credited the Bitcoin Red Team and 12 other named individuals and organizations, along with anonymous security researchers, for reporting vulnerabilities addressed by the update.

Vulnerabilities Could Affect Nodes and User Funds

Several of the patched vulnerabilities involved potentially serious operational consequences for Lightning node operators.

According to the changelog, some flaws could allow an attacker to crash a sender’s node. Another vulnerability involved requests capable of exhausting memory through the software’s REST interface.

A separate channel-closing vulnerability could potentially result in users losing funds through a penalty mechanism.

The combination of node availability and potential financial impact makes timely software updates particularly important for operators managing Lightning channels and balances.

Developers Withheld Some Security Details

Core Lightning deliberately omitted certain tests from the initial release information surrounding the fixes. The decision was intended to make it more difficult for attackers to reverse-engineer the vulnerabilities while node operators had time to install the patched version.

The latest warning that attackers are targeting unpatched nodes suggests that the development team remains concerned about the exposure of operators who have not applied the available security updates.

Core Lightning has not publicly identified the vulnerabilities being exploited in the reported attacks.

Earlier Security Concerns

The latest incident follows another security-related development in August, when Core Lightning said it was dealing with a high volume of AI-generated Common Vulnerabilities and Exposures reports.

The team said it was working on a coordinated fix after assessing the reports and subsequently released version 26.06.7 two days later to address vulnerabilities that had been confirmed.

The sequence highlights the continuing challenge of distinguishing genuine security issues from automated or unreliable vulnerability reports while maintaining the security of widely deployed open-source financial infrastructure.

Outlook

Core Lightning’s latest warning places immediate attention on operators still running versions 26.06.7 or earlier. While the team has not disclosed the specific vulnerabilities involved in the reported attacks, the existence of active targeting makes the latest security release particularly relevant for node operators.

The incident also underscores the importance of coordinated vulnerability disclosure, rapid patch deployment and careful handling of technical details when security fixes affect infrastructure responsible for managing Lightning Network transactions and user funds.