The community Lightning Network implementation bringing instant, low-cost, global micropayments to Bitcoin.
Layer-2
Joined May 2019
- Tweets1.4K
- Following291
- Followers12.9K
- Likes1.1K
Pinned Tweet
Core Lightning 26.06.8 is out, and every node runner should upgrade.
This release fixes vulnerabilities responsibly reported over recent weeks. There is no embargo period: the release and fixes are available right now.
A number of tests are being held back temporarily to make the underlying issues harder to reverse-engineer while node runners have time to upgrade.
Please upgrade as soon as possible.
github.com/ElementsProject/l…
cln-application 26.09 is out.
It moves the app to Node 22, adds optional native HTTPS and reverse-proxy support, and tightens how passwords, sessions, and settings are handled. We recommend upgrading.
github.com/ElementsProject/c…
Security Advisory: We are investigating reports of a potential issue affecting experimental features in Core Lightning that may impact user funds.
We urge all Core Lightning users running experimental features to disable them immediately while we investigate.
Update: the 26.06.7 Docker image has been refreshed with the full security fix.
If you're running it via Docker, pull the latest tag now: hub.docker.com/r/elementspro…
Core Lightning 26.06.7 is out and recommended for every node runner.
It fixes vulnerabilities reported over the past three weeks, during a sharp rise in AI-generated reports across open source Bitcoin. Details stay under embargo for two weeks, then all published.
github.com/ElementsProject/l…
Core Lightning 26.06.7 is out and recommended for every node runner.
It fixes vulnerabilities reported over the past three weeks, during a sharp rise in AI-generated reports across open source Bitcoin. Details stay under embargo for two weeks, then all published.
github.com/ElementsProject/l…
Core Lightning ⚡️ retweeted
Well, seeing that our @Core_LN pre-announcement caused a bit of a kerfuffle, let me talk about the what, why, and when of the upcoming CLN v26.06.7 point release. 🧵
First of all: no need to panic. We are not aware of any vulnerability being actively exploited. 1/6
To be clear about what we are recommending: you do not need to shut your node down.
Our advice is to upgrade. When the release lands, verify the signatures and install it, and do that promptly rather than eventually.
--offline is the alternative for anyone who is not going to upgrade. The flag closes peer connections, so nothing routes in, out or through you, while leaving the daemon up. That is why we suggest it over a shutdown: a live daemon still follows the chain and can respond if a counterparty force-closes, a stopped one cannot.
If you do run with --offline, take the flag back out once you upgrade or the node will stay disconnected.
Core Lightning has been triaging a high volume of AI-generated CVE reports over recent weeks. Several are real, and a coordinated fix is underway.
What to do now: do not shut your node down. Restart it with --offline.
That flag stops peer connections, so no payments route in, out or through your node. It keeps running, which means it keeps watching the chain and can still act if a counterparty force-closes a channel. A node that is powered off cannot do that, and that is why switching off is the worse option.
On @umbrel or @start9labs this is a startup setting for Core Lightning, not a toggle in the dashboard.
What happens next: signed binaries will be published. Verify the signatures before you install, then bring your node back online. Source and reproducible builds follow afterwards so anyone can audit what changed.
github.com/ElementsProject/l…
Core Lightning has been triaging a high volume of AI-generated CVE reports over recent weeks. Several are real, and a coordinated fix is underway.
What to do now: do not shut your node down. Restart it with --offline.
That flag stops peer connections, so no payments route in, out or through your node. It keeps running, which means it keeps watching the chain and can still act if a counterparty force-closes a channel. A node that is powered off cannot do that, and that is why switching off is the worse option.
On @umbrel or @start9labs this is a startup setting for Core Lightning, not a toggle in the dashboard.
What happens next: signed binaries will be published. Verify the signatures before you install, then bring your node back online. Source and reproducible builds follow afterwards so anyone can audit what changed.
github.com/ElementsProject/l…
If you run Core Lightning: when the release is published: upgrade with signed binaries, or start your node with `--offline`.
Details stay under embargo for two weeks. Previous releases, including 26.04, are unsupported.
Full details when the embargo lifts. The 26.09 release is still planned for late September.
Like many open source Bitcoin projects, CLN has received a number of AI-generated CVE reports from multiple sources over the past 10 days. Our small team, together with several invaluable open source contributors, has been working intensively to validate and triage these reports and develop fixes where needed.
We’re now working through a broader remediation strategy. The first step is a point release containing many of these fixes, and we will strongly recommend upgrading. We’re aiming to have an initial version of the point release available within the next few days.
The official Core Lightning app from @Blockstream is a dashboard you host yourself, connected straight to your own node.
Its Volume Chart maps routing traffic inbound to outbound, channel by channel, so you can see which channels earn their capital and which sit idle.
Run a node, route payments, watch it work. One-click on @umbrel or @start9labs, or run it from source: github.com/ElementsProject/c…
Core Lightning ⚡️ retweeted
In this week update by @TumaBitcoiner, we feature the current effort from the LDK team (@lightningdevkit) to add support for recurrent payments in BOLT12. We also discuss a new plugin for Core-lightning (@Core_LN) to rebalance channels in a node.
We also cover the most interesting news from the Bitcoin ecosystem. Notably, we talk about Iceberg, a new nested threshold MuSig2 signature scheme, that allows Lightning operators to thresholdize one participant inside a multi-signature protocol.
Like many open source Bitcoin projects, CLN has received a number of AI-generated CVE reports from multiple sources over the past 10 days. Our small team, together with several invaluable open source contributors, has been working intensively to validate and triage these reports and develop fixes where needed.
We’re now working through a broader remediation strategy. The first step is a point release containing many of these fixes, and we will strongly recommend upgrading. We’re aiming to have an initial version of the point release available within the next few days.
The official Core Lightning app from Blockstream is a dashboard you host yourself, connected straight to your own node.
Account Events tracks every sat across every channel, day by day, so you can see exactly where your liquidity has been.
Self hosted, and it talks to your node over an encrypted Commando connection with rune permissions you control.
One-click on @umbrel or @start9labs, or run it from source: github.com/ElementsProject/c…
Core Lightning ⚡️ retweeted
In case someone is asking what about my lightning node during the period
I made an easy explorer where you can see the lightning transactions on the two different chains bip110.grok.me
Stay safe out there with your lightning node!