Core Lightning Patched a Cheating Bug. Unpatched Nodes Are Still Wide Open.

JUST IN: Core Lightning patched a flaw that could've let a cheating peer broadcast a revoked channel state and skip the penalty entirely. The fix shipped in v26.06.7. Plenty of nodes haven't taken it yet.

Here's why that matters. Lightning's security model leans on one brutal incentive. If you close a channel with an old state, your counterparty gets everything. Every satoshi. That's the penalty transaction, and it's the reason routing nodes sleep at night.

Take that away and you're not running a payment network anymore. You're running a trust exercise.

The Timeline

The flaw lived quietly until someone found it. The fix landed in Core Lightning's GitHub repo as pull request #9509, patching the channel-close path in v26.06.7.

Then Bitcoin Optech published its explanation on Sept. 25, and that's when the whole thing went public. Standard order of operations. Fix first, disclose later, give operators a window to upgrade before someone with bad intentions reads the newsletter.

But not every deployment moves at the speed of a git tag. Older Core Lightning builds are still out there. So are some early Docker images, the ones baked before the patch and never rebuilt. Those images pull an upgrade check that points at a version in need of replacing. If your container's running one, you're exposed until you rebuild it.

The patch is public now. So is the bug it fixes.

What Broke, And Who Felt It

Nothing blew up on mainnet as far as anyone's saying. Good news. This is a patched-and-disclosed situation, not a funds-lost situation.

The bad news is the tail. Node operators are famously slow upgraders. Not laziness. Running a Lightning node is a chore, and if it's routing and earning, you don't touch it. Every second of downtime is lost fees.

So why does a bug that's already fixed still matter? Because disclosure turns a private vulnerability into a public treasure map. Anyone sitting on an unpatched build after Sept. 25 is the slow gazelle.

And just like that, an upgrade reminder becomes a security deadline.

What To Watch Next

Check your version. If you're on anything before v26.06.7, you've got work to do tonight. If you spun up a Docker container months ago and forgot about it, go look at the image tag. That's the group most likely to get caught flat-footed, and they won't find out until it's expensive.

Watch for other implementations to publish their own post-mortems too. When one Lightning client has a channel-close bug, the others owe their users an answer about whether the same logic lives in their code. Core Lightning's fix is specific to Core Lightning. The class of bug isn't.

Also watch how fast the migration actually happens. If operators move quickly, this stays a footnote. If they don't, expect someone to test it. That's how these things work. A penalty mechanism only deters cheating if cheaters actually get penalized.

The market's verdict: patch it, rebuild it, then forget it. Just don't be the node that forgot first. This changes things for anyone who assumed a running node was a safe node. It isn't, and it never was.