CLN users: older versions of the webpki-roots dependency (RUSTSEC-2026-0381) still trust compromised emSign intermediate certificates, which may expose HTTPS requests to potential MITM attacks. Core CLN code and the Lightning protocol are unaffected. The vulnerability is limited to the currencyrate (cln-currencyrate) plugin, which is enabled by default. Exposure is possible when: - Using commands provided by the currencyrate plugin - Configuring bkpr-currency for the bookkeeper plugin The BIP353 plugin is unaffected in practice. Its upstream dependency includes an LNURL fallback path that uses HTTPS, but CLN's BIP353 plugin relies on DNS resolution and ignores the LNURL fallback result, so the affected TLS certificate validation path is not used. If you don't need currencyrate, disable it by adding this to your CLN configuration: disable-plugin=cln-currencyrate A fix is pending the relevant upstream dependency updates and a subsequent CLN release. Nodes not using the affected currencyrate functionality are not expected to be exposed, even with the plugin enabled.

Core Lightning 26.06.9 is out. Upgrade now. It fixes a newly reported vulnerability that can lead to loss of funds. Nodes running 26.06.8 or earlier are affected. Verify the signatures and install it as soon as possible.

Urgent security update: If you’re running version 26.06.7 or earlier, please upgrade to the latest release as soon as possible. We’ve received reports that attackers are targeting unpatched nodes. Keeping your node up to date is an important step in protecting your funds.

cln-application 26.09 is out. It moves the app to Node 22, adds optional native HTTPS and reverse-proxy support, and tightens how passwords, sessions, and settings are handled. We recommend upgrading.

Core Lightning 26.06.8 is out, and every node runner should upgrade. This release fixes vulnerabilities responsibly reported over recent weeks. There is no embargo period: the release and fixes are available right now. A number of tests are being held back temporarily to make the underlying issues harder to reverse-engineer while node runners have time to upgrade. Please upgrade as soon as possible.

Security Advisory: We are investigating reports of a potential issue affecting experimental features in Core Lightning that may impact user funds. We urge all Core Lightning users running experimental features to disable them immediately while we investigate.

Core Lightning 26.06.7 is out and recommended for every node runner. It fixes vulnerabilities reported over the past three weeks, during a sharp rise in AI-generated reports across open source Bitcoin. Details stay under embargo for two weeks, then all published.

Well, seeing that our @Core_LN pre-announcement caused a bit of a kerfuffle, let me talk about the what, why, and when of the upcoming CLN v26.06.7 point release. 🧵 First of all: no need to panic. We are not aware of any vulnerability being actively exploited. 1/6

To be clear about what we are recommending: you do not need to shut your node down. Our advice is to upgrade. When the release lands, verify the signatures and install it, and do that promptly rather than eventually. --offline is the alternative for anyone who is not going to upgrade. The flag closes peer connections, so nothing routes in, out or through you, while leaving the daemon up. That is why we suggest it over a shutdown: a live daemon still follows the chain and can respond if a counterparty force-closes, a stopped one cannot. If you do run with --offline, take the flag back out once you upgrade or the node will stay disconnected.

Core Lightning has been triaging a high volume of AI-generated CVE reports over recent weeks. Several are real, and a coordinated fix is underway. What to do now: do not shut your node down. Restart it with --offline. That flag stops peer connections, so no payments route in, out or through your node. It keeps running, which means it keeps watching the chain and can still act if a counterparty force-closes a channel. A node that is powered off cannot do that, and that is why switching off is the worse option. On @umbrel or @start9labs this is a startup setting for Core Lightning, not a toggle in the dashboard. What happens next: signed binaries will be published. Verify the signatures before you install, then bring your node back online. Source and reproducible builds follow afterwards so anyone can audit what changed.

In this week update by @TumaBitcoiner, we feature the current effort from the LDK team (@lightningdevkit) to add support for recurrent payments in BOLT12. We also discuss a new plugin for Core-lightning (@Core_LN) to rebalance channels in a node. We also cover the most interesting news from the Bitcoin ecosystem. Notably, we talk about Iceberg, a new nested threshold MuSig2 signature scheme, that allows Lightning operators to thresholdize one participant inside a multi-signature protocol.

Like many open source Bitcoin projects, CLN has received a number of AI-generated CVE reports from multiple sources over the past 10 days. Our small team, together with several invaluable open source contributors, has been working intensively to validate and triage these reports and develop fixes where needed. We’re now working through a broader remediation strategy. The first step is a point release containing many of these fixes, and we will strongly recommend upgrading. We’re aiming to have an initial version of the point release available within the next few days.

CLN 26.06rc1 is live. Graceful shutdowns, more control over payment amounts, and a smarter payment engine under the hood. Please upgrade and send us your feedback or open an issue on GitHub. This is open source Lightning in action. ⚡