CORE LIGHTNING: ATTACKERS ARE TARGETING UNPATCHED NODES — ANYONE ON 26.06.7 OR EARLIER SHOULD UPGRADE NOW — THE FIX HAS BEEN PUBLIC SINCE SEPTEMBER 22 — NO WORD YET ON WHICH BUG OR WHAT WAS LOST

Core Lightning posted at 9:42 PM ET on October 1, 2026: "Urgent security update: If you’re running version 26.06.7 or earlier, please upgrade to the latest release as soon as possible. We’ve received reports that attackers are targeting unpatched nodes." The latest release is 26.06.8, out since September 22.

That release fixed "vulnerabilities responsibly reported by a number of sources." The code fixes went public the same day. Only "a small number of tests" were held back, to make the bugs harder to find and use. Because 26.06.7 is on the warning list, at least one bug being targeted is one that 26.06.8 fixed. The post does not say which bug, how many nodes were hit, or whether any money was lost.

We wrote on September 22 that holding back tests is a speed bump: once a fix is public, anyone can compare the two versions and see which code changed. Nine days later, the maintainers are reporting attacks. This is the third Core Lightning security push since late August, after the 26.06.7 release on August 28 and the Docker images that showed the new version number without the fixes inside.

What a node runner can check: the version actually running. Upgrade to 26.06.8, and if you run Docker, confirm the image contains it, not just the label. In the maintainers' words, keeping your node up to date "is an important step in protecting your funds." At the time of this writing, bitcoin was $86,676.