Core Lightning Warns of Attacks on Unpatched Bitcoin Nodes

The developers behind Core Lightning, the open-source node software that powers many Bitcoin Lightning Network setups, have issued an urgent call for operators to upgrade after reports that attackers are targeting unpatched nodes. In a message shared on Friday, the project singled out older releases and urged immediate action to reduce exposure.

In the advisory, Core Lightning warned that anyone running version 26.06.7 or earlier should upgrade to the latest release “as soon as possible.” The team did not publicly detail which specific weaknesses are being exploited or what the attackers’ immediate impact could be. Cointelegraph previously attempted to obtain additional context from Core Lightning but no further details were provided in the materials referenced here.

Key takeaways

• Core Lightning says attackers are targeting nodes that have not installed the latest fixes.
• Operators on 26.06.7 or older were told to upgrade immediately.
• The project’s earlier September updates indicate a sequence of identified issues affecting stability and fund safety.
• Release notes for the latest update cite multiple vulnerability fixes, while also withholding certain tests to slow exploitation.
• Core Lightning has described ongoing work to respond to a surge in AI-generated CVE reports earlier this year.

What Core Lightning told node operators

Core Lightning’s security notice is straightforward but time-sensitive: it targets a specific range of versions and frames the upgrade as necessary due to active exploitation attempts against unpatched deployments.

While the project did not name the vulnerabilities in the Friday post, it made clear that the situation warrants faster-than-usual maintenance. For operators, this effectively turns what might otherwise be a routine patch cycle into an immediate risk-reduction step—especially for nodes that have not been regularly updated or that run in environments where upgrade windows are constrained.

The project did not provide an estimated scale of the attacks, nor did it specify the technical conditions attackers require beyond the absence of fixes.

September timeline: investigation, then patch

The latest urgency follows an earlier phase of the same broader security cycle. On Sept. 16, Core Lightning said it was investigating reports of a potential issue involving experimental features that could affect user funds.

Approximately six days later, the team released version 26.06.8. That update combined bug fixes with security patches for vulnerabilities that were “responsibly reported by a number of sources.” The release notes credited the Bitcoin Red Team, 12 other named individuals and groups, and also acknowledged anonymous reporters.

This sequencing matters because it shows the team moved from investigation to a public patch relatively quickly—while also signaling that the most serious risks were tied to areas that may not be exercised by every operator (experimental functionality).

Which issues were fixed in the 26.06.8 release

According to the changelog for the Sept. 22 update, the fixes addressed multiple classes of problems, including:

• Flaws that could crash senders’ nodes.
• Requests that could exhaust memory via Core Lightning’s REST interface.
• a channel-closing bug that could lead to users losing funds to a penalty.

For lightning infrastructure operators, these categories are significant because they span both availability and loss-of-funds risk. Crashes can degrade routing and liquidity management, while memory exhaustion can create denial-of-service conditions. The channel-closing defect is particularly consequential since it relates directly to the settlement behavior during channel termination.

The release notes also indicate that Core Lightning withheld some tests. The stated rationale was to make it harder for attackers to reverse-engineer the vulnerabilities and use the information to exploit systems before upgrades are widely applied. That approach reflects a tension common in incident response: balancing transparency for defenders with limiting attacker guidance.

Broader security pressures: CVE volume and coordinated fixes

Core Lightning’s security work has also been shaped by a broader influx of vulnerability reporting. In August, the project said it was coordinating a fix after assessing a high volume of AI-generated CVE reports over preceding weeks.

Two days after that update, Core Lightning released 26.06.7 to address confirmed vulnerabilities. The current advisory urging upgrades from 26.06.7 or earlier suggests the security process continued beyond that earlier patch, culminating in additional fixes and an expedited response once reports of exploitation began circulating.

For the community, the practical takeaway is that lightning node operators should treat update schedules as risk controls rather than optional maintenance—especially when upstream projects are explicitly warning about attackers and unpatched exposure.

What to watch next

Operators should focus on deploying the latest Core Lightning release promptly and verify that their monitoring and backup procedures align with the kinds of failures described in the changelog—node crashes, REST-facing memory exhaustion, and channel closing behavior. Beyond upgrades, the open question is whether Core Lightning will provide further technical detail about the active exploitation attempts and which node configurations are most at risk.