Core Lightning Issues Emergency Update for Critical Security Flaws

The Core Lightning software has released an emergency update to fix several confirmed security vulnerabilities. The update, version 26.06.7, was shipped on August 28, 2026, and closes several reported flaws in the code. Node operators using the Core Lightning software must update their nodes as soon as possible or restart them with the --offline switch if an immediate update is not feasible.

The security vulnerabilities were discovered using AI tools and confirmed by the CLN team. The project's instruction was to restart the node with the --offline switch instead of shutting it down, which would block connections to other nodes and close the attack path. No losses have been reported so far, but the technical core of the flaws will be revealed in mid-September.

The update is specific to the Core Lightning software, and other implementations of the Lightning network are not affected. Node operators using a different implementation or running their own node on a third-party package do not need to take action. However, it's essential for all node operators to check the signature of the program file before installing the update.

The --offline switch removes the attack path by taking away any means for attackers to address the node at all, while the program keeps running and reading the blockchain in order to detect attempted fraud. This mode blocks connections from outside and prevents payments from being sent or received, but it does not affect the node's ability to react to events on the blockchain.