Patch Released Sept 22, Attack Reports Arrived Oct 1
Core Lightning shipped version 26.06.8 on September 22, patching three classes of bugs that could crash nodes, exhaust memory, or cost users their channel funds. Ten days passed. On October 1, the team received reports that attackers were scanning for and targeting operators still running 26.06.7 or earlier. The alert went public October 2.
That window matters. Every day between the patch and the warning was a day unpatched nodes sat exposed while attackers tooled up. The patch carried no embargo period, meaning technical details were public from release. Operators who didn't upgrade immediately became targets.
Three Bugs, One Withheld Detail
The 26.06.8 release notes describe a crash-on-send bug affecting sender nodes, memory consumption through REST interface requests, and a channel-closing defect that risks fund loss via the penalty mechanism. That last one is the critical failure: Core Lightning was misidentifying revoked channel commitments as cooperative closes, potentially allowing a cheating peer to retain funds that should have been forfeited.
Core Lightning deliberately withheld some test details from the release to make reverse engineering harder. The team stated they "temporarily withheld a small number of tests to make it more difficult for prospective attackers to quickly identify, reverse-engineer, and exploit the underlying vulnerabilities in the wild." The tactic bought time, but not enough to close the gap before attacks began.
Similar security lapses have surfaced across crypto infrastructure recently. A MetaMask staking breach in late September triggered a $1.4 billion validator exit after a $1,000 proof-of-concept theft exposed control flaws. Ethereum's Glamsterdam upgrade slipped its timeline three times before finally targeting October 6 for the Sepolia testnet fork, narrowing the window for operators to prepare.
AI Found the Bugs in August
The vulnerabilities surfaced through AI-generated CVE reports submitted over roughly 10 days starting around August 13. By August 23, Core Lightning publicly acknowledged the incoming reports and launched what became a 14-day emergency response. The team urged operators to either install signed, patched binaries or run their nodes offline while developers validated the reports and prepared fixes.
Version 26.06.7 shipped August 28 with an embargo on technical details. That embargo lifted after 14 days, during which Core Lightning maintained reproducible builds and released signed packages to verify authenticity. The September 22 patch followed, addressing the remaining bugs without a similar embargo.
The reliance on AI for vulnerability discovery is accelerating across the industry. Core Lightning credited the Bitcoin Red Team, twelve named contributors, and anonymous reporters for the August findings. One source noted that "a tidal wave of reports using AI software have recorded numerous bugs across the industry," including earlier exploits in Coldcard firmware.
No Confirmed Losses, But the Clock Ran Out
Core Lightning reported no confirmed fund losses or successful exploits as of October 2. That restraint in messaging doesn't erase the exposure window. Nodes running 26.06.7 or earlier sat vulnerable from September 22 until they upgraded, and attackers had the patch code in hand to study.
The Lightning Network operates roughly 17,400 public nodes as of mid-2026, down from a 2022 peak near 20,700. LND commands the majority of deployments, bundled with distributions like Umbrel and RaspiBlitz. Core Lightning is one of four major implementations alongside LND, Eclair, and LDK. The alert applies only to Core Lightning nodes, not other implementations or Bitcoin itself.
Understanding wallet security fundamentals becomes critical when infrastructure failures surface. Operators managing Lightning channels should review multisig wallet configurations and consider whether their setup isolates channel funds from broader holdings.
The October 2 alert stated plainly: "Every unpatched node past this point is a conscious choice to stay exposed." The patch existed for 10 days before that warning. For operators who waited, the choice was made for them.