Core Lightning warns of attacks on unpatched Bitcoin nodes

While Core Lightning did not specify the exact vulnerabilities being exploited or the potential impact on users, a previous update released around September 22 (version 26.06.8) addressed several flaws. These included issues that could crash senders' nodes, exhaust memory in its REST interface, and a channel-closing bug that could result in users losing funds to a penalty. The release notes credited the Bitcoin Red Team and other individuals and groups for responsibly reporting these vulnerabilities.

Notably, the September 22 update deliberately withheld some tests to make it more difficult for attackers to reverse-engineer and exploit vulnerabilities while operators were upgrading. This advisory follows an August incident where Core Lightning released version 26.06.7 to address confirmed vulnerabilities after observing a high volume of AI-generated Common Vulnerabilities and Exposures (CVE) reports.