Core Lightning has issued an urgent warning to Bitcoin Lightning Network node operators after receiving reports that attackers were targeting nodes that had not installed recent security updates.
Operators running version 26.06.7 or any earlier release were told to upgrade to the latest version as soon as possible. The open-source software team did not identify the vulnerabilities being targeted or disclose how many nodes may have been affected. According to Cointelegraph, Core Lightning also did not immediately provide further details about the reported attacks.
What operators were told
The warning applies to software used to operate nodes on the Bitcoin Lightning Network, a system designed to enable transactions through payment channels outside the Bitcoin blockchain’s main layer. Node operators help route payments and manage those channels, making software security important to the funds and operations connected to them.
Core Lightning posted its alert on Friday, describing the upgrade as an urgent security update. It specifically covered versions 26.06.7 and older, directing users to install the latest release rather than continue running an unpatched version.
The team has not said whether the attackers successfully exploited any of the flaws or whether users’ funds were lost as a result of the reported activity.
Recent vulnerability disclosures
The warning follows a series of security-related releases. On Sept. 16, Core Lightning said it was investigating a potential problem involving experimental features that could affect user funds. About six days later, it released version 26.06.8.
The Sept. 22 release included general bug fixes and patches for vulnerabilities reported responsibly by multiple sources. Its release notes credited the Bitcoin Red Team, 12 other named individuals and groups, and anonymous reporters.
According to the changelog, the fixes addressed several types of problems:
- A flaw that could crash nodes sending payments.
- Requests capable of exhausting memory in the software’s REST interface.
- A channel-closing issue that could cause users to lose funds through a penalty.
Core Lightning intentionally left out some tests from the release documentation. The aim was to make it more difficult for attackers to reverse-engineer the vulnerabilities while operators had time to update their software.
Earlier security work and market picture
The latest alert also follows a disclosure in August, when Core Lightning said it was coordinating a fix after receiving a high volume of artificial-intelligence-generated Common Vulnerabilities and Exposures reports. Two days later, the project released version 26.06.7 to address the vulnerabilities it had confirmed.
Moneyiar market data at the stated times shows mixed performance among the listed assets. Telcoin (TEL) was priced at $0.0019505649 at 09:19 on Oct. 3, 2026, down 10.33% over 24 hours but up 20.75% over seven days. Ore (ORE) stood at $114.3367036058 at 09:18 the same day, falling 7.62% in 24 hours while gaining 38.03% over seven days. Core (CORE) was $0.0239017302 at 12:13 on Sept. 25, up 4.6% over 24 hours and 23.16% over seven days. Light (LIGHT) was $0.1672899542 at 02:53 on Sept. 14, up 1.73% over 24 hours but down 9.4% over seven days. These figures are Moneyiar data and are not a measure of the security status of Lightning Network software.
