P700 / / Crypto
Core Lightning nodes under attack: upgrade to 26.06.8 now
Core Lightning warns that attackers are probing nodes on 26.06.7 or older. What the patch fixes and who needs to act.
On 2 October the Core Lightning team posted an urgent notice: if your node runs version 26.06.7 or earlier, upgrade now. Attackers are reported to be probing nodes that have not installed the latest release.
The fix is not new. Version 26.06.8 has been available since 22 September. What changed this week is that someone appears to be actively trying the holes on nodes whose operators have not got round to updating.
What Core Lightning is
Core Lightning (often written CLN, formerly c-lightning) is one of the main open-source implementations of the Lightning Network, the layer on top of Bitcoin that makes small, fast payments possible. It runs the nodes that route those payments and hold channel balances. If you run your own Lightning node, there is a fair chance it is CLN, LND, Eclair or LDK underneath.
The team's message was short: "If you're running version 26.06.7 or earlier, please upgrade to the latest release as soon as possible."
What the patch fixes
According to the release coverage, 26.06.8 closes three kinds of bugs:
- A crash when sending. A flaw that could take down a node while it was making a payment.
- Memory exhaustion through the REST interface. Requests that could eat a node's memory until it falls over.
- A channel-closing bug. Under certain conditions, a channel close could trigger the penalty mechanism against the user and lose funds.
The last one is the serious one. Lightning's penalty system exists to punish anyone who tries to cheat by broadcasting an old channel state. A bug that turns that mechanism against an honest user is exactly the kind of thing you want patched before someone finds a way to trigger it on purpose.
What we don't know yet
Quite a lot, and that's deliberate. Core Lightning has not said which of the patched bugs attackers are going after, how many nodes are affected, or whether anyone has lost money. Full technical details are being held back to slow down anyone trying to reverse-engineer the fixes into working attacks.
Context: this is the second security round for the project since August, when developers had to work through a wave of AI-generated vulnerability reports. Most such reports are noise, but this batch produced several confirmed issues, fixed earlier in 26.06.7 (28 August) and now in 26.06.8.
Who needs to do something
If you run a Core Lightning node, on a home server, a Raspberry Pi node package or a VPS: check your version and upgrade to 26.06.8 or later today. If your node came bundled in a node distribution, check whether the bundle has already shipped the update; some lag behind upstream by days.
If you only use a phone wallet, you are probably not running CLN yourself. Many popular wallets are custodial or built on other implementations. It is still worth a look at your wallet's release notes this week, and keeping the app updated is the boring advice that keeps working.
If you run a shop or bar that takes Lightning, ask whoever runs your payment backend which implementation it uses and which version. That is a five-minute conversation, and much cheaper than finding out the hard way. (We take Lightning at our own crypto bar, so this is the conversation we are having too.)
The bigger picture
Lightning is software holding real money on internet-facing machines. Patches that sit uninstalled for ten days are exactly what attackers look for. The fix existed; the gap was operators. Updating is not exciting, but it is the job.
Not financial advice.