Core Lightning released v26.06.7 on August 28, 2026 as a point release carrying fixes for multiple security vulnerabilities reported by external researchers. The project has not disclosed the technical details: source code will not be published until a two-week embargo ends.
The release notes cite a rising volume of security reports. "Increasingly capable AI models are being used to identify potential vulnerabilities in open-source code," the project writes, "significantly increasing the volume and pace of security reports." The delay between release and source publication is designed to slow attackers reverse-engineering the fixes before the network updates.
Operators are expected to update their nodes. Initial Docker images published for this release do not contain the fixes, despite reporting v26.06.7 on startup; corrected images replace them shortly. Users pinned to v26.06.6 or earlier are unaffected by that image issue.
What would falsify this reading: if the technical details are withheld beyond the stated window, or if some fixes prove incomplete once the source is published, the real security impact could be larger than the announcement implies.
https://github.com/ElementsProject/lightning/releases/tag/v26.06.7