Core Lightning, the Lightning Network implementation maintained by Bitcoin infrastructure firm Blockstream, has urged node operators to upgrade to version 26.06.7 after developers identified several security vulnerabilities in the software.

The emergency release, issued Aug. 28, addresses issues reported during a 10-day review that included security reports generated with the help of artificial intelligence. Developers verified several of the findings and shipped fixes, while keeping the technical details private under a two-week disclosure embargo. Automated reports of that kind generally require human review because they can include false positives, which keeps verification central to the process.

Core Lightning, written in C and formerly known as c-lightning, is one of the main implementations of the Lightning protocol, alongside LND from Lightning Labs and Eclair from ACINQ. It is used by operators running Lightning Network nodes, the second-layer payment infrastructure built on top of Bitcoin that processes payments off-chain for faster, cheaper transactions before settling on the blockchain. Developers have not disclosed the full nature of the vulnerabilities, leaving their potential impact unclear.

Operators Face a Deadline

The embargo is designed to give operators time to install the fixes before researchers publish the details in mid-September. Coordinated disclosure windows of this kind are standard practice in software security, weighing the eventual publication of details against users' need to patch first. Nodes that remain unpatched could face greater risk once the vulnerabilities become public.

Core Lightning recommends using signed binaries when installing version 26.06.7. Operators unable to upgrade immediately can use the –offline flag, which starts the node without connecting to the Lightning Network, to monitor their nodes until they complete the update.

Legacy Versions Lose Support

Versions 26.04 and older no longer receive security fixes. The latest release follows version 26.06.6, which was published July 22. Earlier this year, developers fixed denial-of-service flaws affecting versions 26.04 and 26.06rc2.

The latest findings add to ongoing scrutiny of Lightning Network security, as automated tools make it easier to identify weaknesses in widely used software. AI-assisted auditing has been spreading across open-source security, with fuzzing and code-review platforms adding language-model components, and this review follows that pattern: machines widen the search, maintainers confirm what holds up. The full technical details, due when the embargo lifts in mid-September, will show what the process uncovered.

Source: CryptoNewsNet