Core Lightning Warns of Active Attacks on Unpatched Nodes
Core Lightning issued an urgent security warning October 2: attackers are actively targeting nodes on v26.06.7 or earlier. The patch has been available since September 22. Every unpatched node past this point is a conscious choice to stay exposed.
Operators still on v26.06.7 or earlier are being targeted right now. The patch has been public for ten days.
Key takeaways
- Core Lightning issued an urgent warning on October 2, 2026: attackers are actively targeting nodes running v26.06.7 or earlier; upgrade to v26.06.8 immediately.
- The September 22 patch closes three confirmed bug classes, including a channel-closing flaw that can cause operators to lose funds to a penalty mechanism.
- This is the second emergency security cycle for Core Lightning since August, when AI-generated CVE reports surfaced multiple confirmed vulnerabilities; that same AI-assisted tooling now appears to be on the offensive side.
The Core Lightning team issued an urgent security warning on Friday, October 2, 2026, stating that attackers are actively targeting nodes running version 26.06.7 or earlier. The fix, v26.06.8, has been available since September 22. There is no longer any reason to be on an unpatched version.
"Urgent security update: If you're running version 26.06.7 or earlier, please upgrade to the latest release as soon as possible," the team stated in their October 2 post, first reported by Cointelegraph. The team did not specify which vulnerabilities are being targeted or detail confirmed fund losses. The situation remains live and developing.
What the Patch Closes
The v26.06.8 release notes document three confirmed bug classes. First, a crash-on-send bug that can take down a sender's node. Second, requests to the REST interface that can exhaust memory. Third, a channel-closing bug that can cause operators to lose funds to a penalty. All three were responsibly disclosed and credited to the Bitcoin Red Team, twelve other named individuals and groups, and anonymous reporters.
The release carries one deliberate limitation: some test details were withheld to slow attacker reverse-engineering while operators upgrade. Per the release notes: "We have temporarily withheld a small number of tests to make it more difficult for prospective attackers to quickly identify, reverse-engineer, and exploit the underlying vulnerabilities in the wild." Unlike the prior v26.06.7 release, which carried a fourteen-day embargo, v26.06.8 is available immediately with no embargo.
Blockstream's official Stacker News post confirmed the posture: "This release fixes vulnerabilities responsibly reported over recent weeks. There is no embargo period: the release and fixes are available right now," per @blockstream_official on Stacker News.
AI on the Offensive Side Now
This is not an isolated incident. In August, Core Lightning received a high volume of AI-generated CVE reports over a ten-day period, triaged them, confirmed several, and shipped v26.06.7 on August 28 to address them. That AI-assisted vulnerability discovery compressed the defensive timeline dramatically. Now the same dynamic appears to be playing out on the other side: attackers scanning for operators who haven't patched, using tooling that makes target identification cheap and fast.
The withheld test details buy time, but it's a finite window. The patch has been public since September 22. Every node still running v26.06.7 or earlier as of October 2 is an open target. The Lightning Network's security model assumes operators respond quickly to disclosures. That assumption is now being stress-tested in real time.
Self-sovereign node operation is the right call. Running your own infrastructure, holding your own keys, routing your own payments. But that sovereignty carries an operational cost that custodians absorb on behalf of passive users: you are your own security team. The August AI-CVE cycle already demonstrated how quickly an unpatched node becomes a liability. This is that lesson, repeated under active fire.
The thesis here is straightforward: AI tooling has materially lowered the cost of both finding and exploiting vulnerabilities in open-source Bitcoin infrastructure, and the long tail of operators slow to patch is where attackers go first. That thesis weakens only if Core Lightning walks back the "reports of attackers targeting" claim as unconfirmed, or if full technical disclosure shows the exploited vulnerabilities required sophistication well beyond what AI-assisted scanning enables.
What to Watch
Core Lightning has not confirmed specific fund losses as of October 2. Watch the GitHub repository for full technical disclosure once the patch adoption window closes, and monitor whether LDK and Eclair, which also shipped patches in the same September window, issue any related advisories. If you are running Core Lightning, check your version and upgrade now.
Sources
Frequently Asked Questions
What happens if I don't upgrade my Core Lightning node immediately?
Nodes on v26.06.7 or earlier contain confirmed vulnerabilities that include a crash-on-send bug, a memory exhaustion flaw in the REST interface, and a channel-closing bug that can result in loss of funds to a penalty mechanism. Attackers are reportedly targeting unpatched nodes as of October 2. No confirmed fund losses have been publicly documented yet, but exploitation is reportedly underway.
Is this a Bitcoin protocol vulnerability?
No. This affects Core Lightning, one specific Lightning Network node implementation. Bitcoin's base-layer consensus rules are untouched. LND and other implementations are not known to be affected by these specific bugs.
What role is AI playing in this attack cycle?
In August, Core Lightning received a surge of AI-generated CVE reports; developers confirmed several and patched them in v26.06.7. The current situation suggests attackers are now using similar tooling to identify unpatched operators and target them. AI compresses both the vulnerability discovery timeline and the exploitation window. This is the new recurring dynamic for open-source Bitcoin infrastructure security.
