Core Lightning 26.06.8: security update and guidance for node operators

The Core Lightning project released version 26.06.8 on 22 September 2026, including fixes for bugs and responsibly disclosed vulnerabilities. In the release announcement, the developers strongly recommend upgrading. The announcement concerns this software; it does not mean that every crypto wallet or Bitcoin node runs the component in question. Official release announcement (Opens in a new tab)

The code is available; some tests are delayed

According to the project, the fixes are available without an embargo period. A small number of tests were temporarily withheld to make identifying and reproducing the vulnerabilities harder and allow time to upgrade. The announcement alone does not establish the full extent of actual exploitation. Publishing a fix should not be turned into a headline about stolen funds. Release announcement (Opens in a new tab)

For readers unfamiliar with the network, the Lightning guide provides background before turning to software versions.

A point for operators to note

The operator notes warn that nodes running development versions from the master branch cannot return to version 26.06.x because they use a newer database schema. The recommendation to upgrade is therefore not an instruction to replace every installation with the same file without checking the starting version. Operator notes (Opens in a new tab)

How to approach checks on your installation

We suggest that operators first document the software name, installed version and installation method. Then compare them with the release instructions from the project and the actual package provider. A version number on a news page does not prove that the local service has already been updated.

If another system manages the installation, check its update procedure rather than copying a command from a guide unsuited to the environment. Plan a health check after updating and establish the rollback limitations in advance. This is a general framework, not an upgrade guide tailored to a particular installation.

Users who do not operate nodes can ask their wallet provider whether its service uses this software and whether they need to act. There is no need to disclose a seed phrase to get an answer about a software version; the scam identification guide helps identify suspicious requests.

What we will continue checking

Further coverage will examine additional security publications and official clarifications. Any new details about severity, affected versions or exploitation should be attributed to their source and date. This allows a useful update without presenting missing information as settled.