Core Lightning has urged Lightning Network node operators to upgrade to version 26.06.7 after developers identified several security vulnerabilities in the software.
The emergency release, issued Aug. 28, addresses issues uncovered during a 10-day security review that included reports generated with the help of artificial intelligence. Developers verified several findings and released fixes while withholding technical details under a two-week disclosure embargo.
Maintained by Blockstream, Core Lightning is used by operators running Lightning Network nodes. Developers have not disclosed the full nature of the vulnerabilities, leaving their potential impact unclear.
Lightning Network Operators Face Security Deadline
The disclosure embargo gives operators time to install the fixes before researchers publish additional details in mid-September. Unpatched nodes could face increased risk once the vulnerabilities become public.
Core Lightning recommends using signed binaries when installing version 26.06.7. Operators who cannot upgrade immediately can use the –offline flag to monitor their nodes until the update is complete.
Older Core Lightning Versions Lose Security Support
Versions 26.04 and older no longer receive security fixes. The latest release follows Core Lightning version 26.06.6, which was published July 22.
Earlier this year, developers fixed denial-of-service flaws affecting versions 26.04 and 26.06rc2. The latest findings add to scrutiny of Lightning Network security as automated tools make it easier to identify weaknesses in widely used software.
No Comments