Core Lightning warns attackers are targeting unpatched Bitcoin nodes

The team behind Core Lightning, an open-source node software for the Bitcoin Lightning Network, has urged operators running older versions to upgrade immediately after receiving reports of attackers targeting unpatched nodes.

“Urgent security update: If you’re running version 26.06.7 or earlier, please upgrade to the latest release as soon as possible,” the team said on Friday.

Core Lightning did not specify which vulnerabilities attackers were targeting or the potential impact. Cointelegraph reached out to Core Lightning for comment.

Source: Blockstream

On Sept. 16, Core Lightning said it was investigating reports of a potential issue affecting experimental features in Core Lightning that could impact user funds. It then released version 26.06.8 around six days later.

The Sept. 22 update delivered bug fixes alongside patches for “vulnerabilities responsibly reported by a number of sources.” The release notes credit the Bitcoin Red Team and 12 other named individuals and groups, along with anonymous reporters.

Some of the fixes addressed flaws that could crash senders’ nodes, requests that could exhaust memory in its REST interface and a channel-closing bug that could cause users to lose funds to a penalty, according to the changelog.