Core Lightning, software used to operate nodes on Bitcoin’s Lightning Network, has released version 26.06.9 with multiple security fixes and a correction for a performance problem introduced in the previous release.
The update is aimed particularly at operators running v26.06.8, where a regression could slow channel traffic on busy nodes. Maintainers are urging users to install the new version as soon as practical. According to CryptoSlate, the release was listed on GitHub on October 7, while the versioned changelog is dated October 6.
The latest patch follows a series of security-related changes in recent Core Lightning releases. Version 26.06.7 addressed a flaw involving penalties for revoked channels, while later changes introduced the traffic-handling issue fixed in v26.06.9. Operators who have installed the latest release are therefore being asked to review their upgrade position rather than remain on the affected software.
Regression could delay Lightning channel traffic
One of the main changes concerns how Core Lightning allocates processing capacity. In version 26.06.8, routine network messages—including gossip, ping and onion messages—were counted against a CPU budget intended for gossip queries.
That accounting problem could affect busy nodes. Because ordinary messages used part of the budget, peers could be throttled and channel-related traffic could be delayed. The issue did not concern every type of Lightning activity equally, but it created a documented risk for operators running heavily used nodes on v26.06.8.
Version 26.06.9 separates the traffic categories by reserving the relevant budget for gossip queries. Routine messages will no longer consume that allocation, removing the cause of the throttling described by the maintainers.
For Lightning node operators, the change matters because the network depends on nodes communicating information about channels and payments. Delays in that communication can affect how quickly a node handles activity across its channels, even when the underlying Bitcoin transaction system is functioning normally.
Shutdown fix protects forwarded payments
The release also changes how Core Lightning handles a payment contract known as an HTLC, or hash time-lock contract, when a channel is being shut down.
An HTLC is used in Lightning payments to place conditions and a deadline on the transfer of funds. In a routed payment, a node may forward funds through its channel while waiting for the payment to be completed under those conditions.
Under the problem described in the changelog, an HTLC could reach its deadline while the channel was in the process of shutting down. If the payment was then fulfilled late, funds forwarded through the channel could be exposed to loss.
Core Lightning v26.06.9 now force-closes the channel when an offered HTLC reaches its deadline during shutdown. The change is designed to protect forwarded funds when the payment deadline and the channel’s closing process overlap.
The update includes several additional security controls:
- Restrictions attached to runes, which authorize calls to Core Lightning, are now enforced so a limited rune cannot create an unrestricted one or relist runes that have been blacklisted.
- The relevant restrictions also apply to the corresponding invokerune and destroyrune aliases.
- The listconfigs command now hides sensitive information, including recovery data and Bitcoin RPC passwords, from every caller.
- The setconfig command closes a route for injecting configuration lines through persistent option values.
Upgrade guidance and current Bitcoin market picture
Core Lightning maintainers have made the fixes available but are temporarily withholding security tests. The stated purpose is to make exploit development more difficult while giving node operators additional time to install the patched software.
Operators should also note that nodes that have run a master build cannot be downgraded to a 26.06.x release because the database schema is newer. The release notes continue to identify dual funding as experimental and discourage the use of zero-confirmation channels with untrusted peers.
The maintainers recommend that Core Lightning users, including those still running v26.06.8, upgrade to v26.06.9 as soon as practical. The update addresses both the performance regression affecting busy nodes and the payment-protection issue during channel shutdown.
Moneyiar market data recorded at 11:14 a.m. on October 9, 2026, puts Bitcoin at $82,426.69. BTC was up 0.03% over the previous 24 hours but down 4.64% over seven days. Bitcoin ranked first by market capitalization in the supplied market data.
The same Moneyiar snapshot showed Decimal at $0.3862, up 0.06% in 24 hours and down 9.20% over seven days; FUNToken at $0.008732, up 0.64% over 24 hours and up 5.63% over seven days; and Light at $0.1673, up 1.73% over 24 hours and down 9.40% over seven days. The Light data was timestamped September 14, 2026, at 2:53 a.m. and is therefore not from the same market-data time as the other assets.
