CORE LIGHTNING TELLS NODE RUNNERS TO UPGRADE AGAIN — THE NEW POINT RELEASE STOPS PEERS FROM CRASHING NODES AND GETTING SPLICES SIGNED AT ALMOST NO FEE — RESTRICTED RUNES COULD MINT UNRESTRICTED ONES

Core Lightning published v26.06.9 on GitHub at 13:19 UTC on October 7, 2026, with a plain instruction: “We strongly recommend upgrading to this release.” It lands 15 days after v26.06.8 went out on September 22, and six days after the maintainers warned that attackers were targeting unpatched nodes.

The changelog is the disclosure. Peers could crash nodes: “A channel peer can no longer crash lightningd by RBF-ing a splice into a transaction the node has already recorded.” A splice message for an unknown inflight now fails the channel “instead of crashing the node.” An HTLC with an unreadable onion is now failed as malformed “instead of crashing the node in some cases.” Two fixes touch money directly. When accepting a splice, CLN now enforces the agreed feerate, “so a peer can no longer get us to sign a splice paying (almost) no fees.” And an outgoing HTLC that hits its deadline while a channel is shutting down now force-closes it, “so forwarded funds cannot be lost to a late fulfill.”

The other cluster is runes, the access tokens CLN hands to apps and remote controls. A restricted rune could create a new rune without the restrictions, or relist runes that had been blacklisted. “<code>setconfig</code> no longer permits config-line injection through persistent option values.” And <code>listconfigs</code> now hides <code>bitcoin-rpcpassword</code> and <code>tor-service-password</code> from every caller. If you have given a rune to a wallet app, these are the lines to read.

What the release does not say: no CVE numbers, no advisory, and no word on which of these bugs, if any, were used against live nodes. What a node runner can check is the version actually running, not the label on the package. The release also adds signed reproducible ARM binaries for Ubuntu, so you can compare what you run with what the maintainers built. At the time of this writing, bitcoin was $83,958.