Core Lightning has released an urgent security update addressing multiple confirmed vulnerabilities in software used to operate Bitcoin Lightning nodes.
Core Lightning, commonly abbreviated as CLN, is an open-source implementation of the Bitcoin Lightning Network. It provides the software needed to operate a Lightning node, manage payment channels, and send or route fast, low-cost bitcoin payments without recording every individual payment directly on the Bitcoin blockchain. Formerly known as c-lightning, CLN uses a modular design that operators can expand through plugins.
Core Lightning Version 26.06.7 Quantum-Resistant Lightning Channel VII became available on August 28 after developers spent several weeks examining security reports submitted by members of the open-source Bitcoin community. The project says some of the reports were produced with assistance from artificial intelligence, reflecting the growing use of automated tools to search cryptocurrency software for potential weaknesses.
Core Lightning operators are being urged to install the update as soon as possible. Versions released before 26.06.7 are no longer supported.
The warning applies specifically to Core Lightning, also known as CLN. It should not be interpreted as evidence of a vulnerability in Bitcoin’s base blockchain or every application using the Lightning Network. Core Lightning is one of several independent software implementations that allow operators to create and manage Lightning payment channels.
Why the Source Code Is Temporarily Unavailable
Core Lightning is open-source software, but the developers have temporarily withheld the source code containing the security fixes. The patched binaries were released first, with publication of the corresponding source code scheduled for September 11.
That unusual sequence is intended to give node operators approximately two weeks to install the repaired software. Publishing the changes immediately could reveal which sections of the previous versions were vulnerable, making it easier for an attacker to study the patch and target nodes that had not yet upgraded.
During this temporary period, operators must obtain the signed binaries and verify their digital signatures before installation. Those signatures help confirm that the files came from the legitimate Core Lightning developers and were not replaced with malicious copies.
Once the source code becomes available, independent developers will be able to inspect the changes, rebuild the software and confirm whether their results match the binaries distributed during the protected update period.
The approach creates a temporary compromise between open-source transparency and responsible vulnerability disclosure. Full public review is delayed, but only long enough to give operators an opportunity to protect their nodes.
What Operators Should Do
The project’s primary recommendation is simple: upgrade to Core Lightning 26.06.7, verify the signatures, install the new version and restart the node.
Operators who cannot upgrade immediately are advised to restart Core Lightning using the `–offline` option. This disconnects the node from other Lightning peers, closing the communication path through which the vulnerabilities might be exploited.
Offline mode prevents the node from sending, receiving or routing Lightning payments. However, the software continues running and monitoring Bitcoin’s blockchain.
That distinction is important because simply turning off a Lightning node may introduce a different risk. Payment channels depend on participants monitoring the Bitcoin blockchain for improper or outdated channel closures. A running node in offline mode can continue watching the blockchain even though it is temporarily unavailable to Lightning peers.
Operators should remove the offline option and restart normally after installing the update.
AI Finds Real Software Vulnerabilities
The incident also raises broader questions about artificial intelligence and open-source security. AI-assisted tools can produce large numbers of low-quality or inaccurate reports, creating additional work for maintainers. In this case, however, Core Lightning confirmed that multiple reported vulnerabilities were genuine.
AI may therefore help defenders uncover software weaknesses earlier, but similar tools could also assist attackers. Cryptocurrency projects may need stronger procedures for sorting legitimate findings from automated noise while responding quickly when a report proves credible.
Core Lightning thanked numerous independent researchers and contributors involved in reporting, examining and repairing the vulnerabilities. The project said it intends to continue embracing AI-assisted review to improve the software’s reliability.
The developers have not yet publicly described the precise vulnerabilities or their severity. Those details should become clearer when the source code is released on September 11.
Until then, the most important message is directed at Core Lightning node operators: install version 26.06.7 or run the node in offline mode until the upgrade can be completed.
More information and official instructions are available through Blockstream’s Core Lightning security announcement.
Be First to Comment