The team behind Core Lightning (CLN), the open-source node implementation for the Bitcoin Lightning Network developed by Blockstream, has urged operators running older versions to upgrade immediately after receiving reports of attackers targeting unpatched nodes.

“Urgent security update: If you’re running version 26.06.7 or earlier, please upgrade to the latest release as soon as possible,” the team said on Friday.

Core Lightning did not specify which vulnerabilities the attackers were targeting or what impact the activity could have. Cointelegraph reached out to Core Lightning for comment.

On Sept. 16, Core Lightning said it was investigating reports of a potential issue affecting experimental features in the implementation that could impact user funds. About six days later, on Sept. 22, it released version 26.06.8, which delivered bug fixes alongside patches for “vulnerabilities responsibly reported by a number of sources.” The release notes credit the Bitcoin Red Team and 12 other named individuals and groups, along with anonymous reporters.

According to the changelog, the fixes addressed flaws that could crash senders’ nodes, requests that could exhaust memory in its REST interface, and a channel-closing bug that could cause users to lose funds to a penalty. In the Lightning Network, penalties are the protocol’s mechanism for punishing a node that tries to close a channel with outdated balances — which is what makes that bug a direct path to losing channel funds. The release also deliberately withheld some tests to make it harder for attackers to reverse-engineer and exploit the vulnerabilities while operators upgraded.

The disclosures underline what is at stake for node operators: Lightning nodes hold the funds locked in payment channels and route payments across the network, so a flaw in a widely used implementation like Core Lightning can translate into direct financial exposure rather than an ordinary software bug.

The warning follows an earlier episode in August, when Core Lightning said it was working on a coordinated fix after assessing a high volume of AI-generated Common Vulnerabilities and Exposures (CVE) reports over recent weeks. Two days later, it released version 26.06.7 to address the confirmed vulnerabilities.

What happens next depends on details Core Lightning has yet to provide: the targeted vulnerabilities remain unspecified, and any follow-up advisory or response to the request for comment would clarify the scope of the activity against nodes still running unpatched versions.