Core Lightning patches vulnerabilities in version 26.06.7 amid AI report surge

Core Lightning, the open-source Lightning Network implementation maintained by Blockstream’s ElementsProject, pushed out version 26.06.7 on August 28 as an emergency security release. The update patches multiple vulnerabilities that were surfaced during a roughly 10-day stretch of AI-generated CVE-style reports starting around August 13. The team is keeping specific vulnerability details under a two-week embargo, giving node operators a window to upgrade before potential exploits become public knowledge. For anyone running a Core Lightning node, the message is straightforward: update now or risk exposure. What happened and why it matters Starting in mid-August, the Core Lightning development team began receiving a high volume of vulnerability reports that bore the hallmarks of AI-generated security auditing. The small core team, working alongside external contributors, validated several of the flagged issues as genuine security concerns. That validation process, condensed into about 10 days, culminated in the decision to ship an emergency point release rather than wait for a scheduled update cycle. Version 26.06.7 follows version 26.06.6, which landed on July 22. The project has du...