Core Lightning has released version 26.06.7 to address several undisclosed security vulnerabilities and is recommending that all operators using the Bitcoin Lightning Network implementation upgrade.

The vulnerabilities were reported during the three weeks preceding the August 28th release. 

Their severity, technical characteristics, and potential effects have not been made public, limiting independent assessment of the risks. No exploitation has been publicly reported.

Maintainers distributed signed binaries but withheld the corresponding source code and vulnerability disclosures for 14 days. 

The official release notice says the embargo is intended to give operators time to install the fixes before potential attackers can study them.

The decision involves a tradeoff for an open-source project. Delaying publication may reduce the immediate risk of attackers using the source code to identify vulnerable nodes, but compiled binaries can also be analyzed.

To support later verification, maintainers published a signed checksum for the forthcoming source archive. 

Users will be able to confirm that the source released after the embargo corresponds to the binaries distributed earlier.

The update arrives as open-source Bitcoin projects receive a growing number of AI-generated security reports. 

Core Lightning said increasingly capable AI systems have increased both the volume and speed of vulnerability submissions, placing additional demands on developers responsible for reviewing reports and preparing fixes.

Node operators can install version 26.06.7 using the signed platform-specific tarballs provided with the release. The process requires restarting the lightningd service but does not require a separate database migration.

Operators who choose to wait for the source code have been advised to run their nodes with the --offline option during the embargo. Offline mode is not the same as shutting down the node.

Corrected Docker images for version 26.06.7 are now available.

Images served between August 28th and September 1st reported the new version number but did not contain the security fixes. Those images were published automatically from a placeholder tag and have since been replaced.

Operators who downloaded a Docker image during that period should compare its digest with the current release notice and download it again if it does not match. 

Installations pinned to version 26.06.6 or earlier were not affected by the incorrectly labeled images, although they do not include the latest security fixes.

Separately, GitHub’s automatically generated archives are not the source used to build version 26.06.7. 

The correct source code, detailed vulnerability disclosures, and full instructions for reproducing the binaries are expected after the two-week embargo.