Core Lightning tells operators on version 26.06.7 or earlier to upgrade after node attack reports
Core Lightning urged node operators running version 26.06.7 or earlier to upgrade immediately after reports that attackers were targeting unpatched nodes.
Why it matters
Lightning nodes hold channel balances, so a software flaw on an unpatched node can affect funds directly, and version 26.06.8 with the September patches has been available since Sept. 22. No losses have been confirmed and the targeted vulnerability is still undisclosed, so the size of any exposure is unknown.
Where the sources disagree
How the targeting was characterised
Core Lightning did not specify which vulnerabilities were targeted, and the warning does not establish whether the September fixes are involved
Cointelegraph, Crypto News (CryptoNews.net), Crypto.News
The issue stems from a known weakness that has already been addressed in newer versions, making the update the primary defense
Bitcoin Insider
Cointelegraph, Crypto News and Crypto.News describe the trigger as reports that attackers are targeting unpatched nodes, while Bitcoin Insider describes attackers as actively probing and targeting those nodes.
Key facts
Core Lightning told node operators running version 26.06.7 or earlier to upgrade to the latest release immediately.
Reported by Cointelegraph
Core Lightning said it issued the warning after receiving reports of attackers targeting unpatched nodes.
Reported by Cointelegraph
Core Lightning did not disclose which vulnerabilities are being targeted, what an attacker could achieve, or whether any reported attacks resulted in lost funds.
Disputed figureReported by Cointelegraph
On Sept. 16 Core Lightning said it was investigating reports of a potential issue in experimental features that could impact user funds.
Reported by Cointelegraph
Core Lightning released version 26.06.8 around six days after the Sept. 16 statement, on Sept. 22, with bug fixes and patches for vulnerabilities reported by outside researchers.
Reported by Cointelegraph
The 26.06.8 fixes covered flaws that could crash senders' nodes, exhaust memory through the REST interface and cause users to lose funds to a penalty during channel closure.
Reported by Cointelegraph
The 26.06.8 release notes credit the Bitcoin Red Team, 12 other named individuals and groups and anonymous reporters, and the release withheld some tests to make it harder for attackers to reproduce issues.
Reported by Cointelegraph
Crypto.News reported that the warning follows several Core Lightning security updates since August, when developers confirmed vulnerabilities after reviewing a wave of AI-generated reports.
Reported by Crypto.News
What happened
Core Lightning, the team behind open-source node software for the Bitcoin Lightning Network, told operators running version 26.06.7 or earlier to upgrade immediately, saying in an urgent security notice that it had received reports of attackers targeting unpatched nodes (Cointelegraph, Crypto News, Crypto.News, Bitcoin Insider). The team did not say which vulnerabilities the attacks target, what an attacker could achieve against an unpatched node, or whether any of the reported attacks cost users funds (Cointelegraph, Crypto.News). Crypto.News reported that the warning does not establish whether the reported attacks involve one of the flaws fixed in September or a separate issue, while Bitcoin Insider wrote that the issue stems from a known weakness already addressed in newer versions and that attackers are actively probing older nodes. The background is version 26.06.8, released around six days after Core Lightning said on Sept. 16 that it was investigating a potential issue in experimental features that could affect user funds; the Sept. 22 release patched node crashes, memory exhaustion in the REST interface and a channel-closing bug that could cost users funds to a penalty, and its notes credit the Bitcoin Red Team, 12 other named individuals and groups and anonymous reporters (Cointelegraph, Crypto News). Crypto.News also reported that the warning follows several security updates since August, when developers confirmed vulnerabilities after reviewing a wave of AI-generated reports. Core Lightning did not answer Cointelegraph's request for comment (Cointelegraph).
How the story developed
- Official statement
Core Lightning says it is investigating a possible issue in experimental features
The Sept. 16 statement covered a potential issue that could impact user funds.
- Update
Version 26.06.8 released with security patches
The release arrived around six days after the Sept. 16 statement and its notes credit the Bitcoin Red Team, 12 other named individuals and groups and anonymous reporters.
- First report
First report by Cointelegraph
Core Lightning warns attackers are targeting unpatched Bitcoin nodes
- Update
Cointelegraph reports the Core Lightning upgrade warning
Cointelegraph published first on the urgent security notice telling operators on version 26.06.7 or earlier to upgrade, citing Blockstream as the source of the alert text.
- Official statement
Core Lightning issues urgent security update notice
The team said that if you are running version 26.06.7 or earlier, you should upgrade to the latest release as soon as possible.
- Independent corroboration
Independently corroborated by Crypto.News
Bitcoin Lightning security alert issued as attackers target older Core Lightning nodes
- Update
Crypto.News adds that no lost funds have been disclosed and that updates date back to August
The independent account reports the team has not said whether any reported attacks cost funds, and that the warning follows security updates since August tied to a wave of AI-generated vulnerability reports.
How coverage built up
Independent sources over time, counted the way the consensus panel counts them: a republication of a wire story does not move the line.
- 2 Oct 2026, 04:18 UTC: Cointelegraph — 1 independent source, 1 reports
- 2 Oct 2026, 06:34 UTC: Crypto.News — 2 independent sources, 3 reports
Affected entities
Original sources
| Publisher | Report | Role | Published |
|---|---|---|---|
| Cointelegraph Crypto media | Core Lightning warns attackers are targeting unpatched Bitcoin nodes | Original | |
| Crypto.News Crypto media | Bitcoin Lightning security alert issued as attackers target older Core Lightning nodes | Independent | |
| Crypto News (CryptoNews.net) Aggregator | Core Lightning warns attackers are targeting unpatched Bitcoin nodes | Syndicated | |
| Bitcoin Insider Aggregator | Core Lightning Warns of Active Attacks on Unpatched Bitcoin Nodes | Aggregated |
Related events
Blackrock Report Sidelines Bitcoin in AI Payments as Block Adds Lightning to x402
Blackrock's new report largely leaves bitcoin out of AI agent payments while Block adds Bitcoin Lightning support to the x402 payment protocol.
Tether to issue USDT on Bitcoin in October via Tether-backed project Utexo
Utexo, a Tether-backed project, plans to start issuing USDT on Bitcoin in October with private transfers, direct BTC swaps and bitcoin-backed loans.
Block joins the x402 Foundation and contributes Bitcoin Lightning support
Block joined the x402 Foundation and added Bitcoin Lightning to the HTTP 402 payment standard, announced on September 24, giving AI agents a low-cost rail for small payments.
Bitcoin developer Paul Sztorc criticizes Lightning Network usability while researchers unveil post-quantum defense
Paul Sztorc claims custodial services dominate Lightning payments, while university researchers announce a hybrid post-quantum security implementation for the network.
Core Lightning warns attackers target nodes on 26.06.7, urges upgrade to 26.06.8
Bitcoin.com News reports Core Lightning warned on Oct. 1 that attackers are targeting Bitcoin Lightning nodes running version 26.06.7 or earlier, urging an upgrade to 26.06.8.
WhiteBIT Integrates Lightning Network for Bitcoin Deposits and Withdrawals
Swiss crypto exchange WhiteBIT adds Lightning Network support via Voltage, enabling faster and cheaper bitcoin transactions for its users.