iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Yes, Lightning node operators should upgrade Core Lightning (CLN). The official v26.06.8 release, dated September 22, 2026, is a point release that bundles ordinary bug fixes with fixes for vulnerabilities reported through responsible disclosure, and its release notes recommend upgrading. The official notes do not describe the individual vulnerabilities, and they do not identify the Bitcoin payment bug that the headline mentions. This article covers what is confirmed, what is not, and how to act on each release in the 26.06 series.
Should you update Core Lightning now?
If your node runs any release older than v26.06.8, upgrade. The release notes describe security fixes, and the project recommends the update. What the notes do not provide is a severity rating, a count of fixes, or an estimate of funds at risk, so the upgrade decision should rest on the stated security fixes rather than on any assumed severity. The headline’s word “critical” is not supported by the official notes, and this article does not use it.
Two other points matter for the decision. First, the release notes say a small number of tests were temporarily withheld to make the vulnerabilities harder to reverse-engineer, and that the release was otherwise published without an embargo. Second, a later release, v26.06.9, has been reported by a secondary release tracker, which is covered in its own section below. Operators should check the official Core Lightning release page for the newest version before updating, not only the version named in this article.
What v26.06.8 does and does not tell you
The official v26.06.8 notes confirm three things: the release contains ordinary bug fixes, it contains fixes for responsibly reported vulnerabilities, and the project recommends upgrading. They do not explain how any individual vulnerability works, which versions it affects, or what an attacker could do with it. That silence is deliberate on the project’s side, and it means the article can describe the release but cannot describe the exploit paths.
#1 Best Overall
- BITCOIN EXCLUSIVE, PHONE VERIFICATION: Bitkey is designed from the ground up exclusively for bitcoin — a dedicated hardware wallet for secure bitcoin storage. Approve transactions with a tap using your phone and NFC. No device screen is required.
- SELF-CUSTODY, NO EXCHANGE OR CUSTODIAN REQUIRED: You hold two of the three keys in the Bitkey system – one on your phone and one on your Bitkey device. The third is stored on Bitkey’s server and cannot move your bitcoin on its own.
- NO SEED PHRASE: Set up and use Bitkey without creating or storing a seed phrase.
- 2-of-3 MULTISIG: Three keys are stored separately across your phone, Bitkey device, and Bitkey’s server. Any two keys are required to move your bitcoin.
- BUILT-IN RECOVERY: Encrypted backup and recovery tools can help you regain access if you lose your phone or Bitkey device. You can also designate a Recovery Contact.
The Bitcoin payment bug in the headline is also not identified in the v26.06.8 notes. This article therefore does not state its mechanism, the releases it affects, the payment failure it causes, or the version that fixes it. Readers who see that bug named elsewhere should check the official release page for a matching entry before drawing conclusions about their own node.
The v26.06.7 notice and the interim --offline option
Blockstream published a security update notice on August 28, 2026. It recommended upgrading to v26.06.7. Because the notice was attributed to the Blockstream Team rather than a named author, it should be read as the organisation’s guidance, not as a quote from an individual.
Rank #2
- Unparalleled Security: Protect your assets NDA-free EAL 6+ Secure Element, offering robust defense and complete transparency
- Simple & Secure Interface: Manage your digital assets easily with a clear OLED screen for secure on-device confirmations
- Supports 1000s of Coins & Tokens: Securely handle thousands of assets, including Bitcoin, Ethereum, and more, all in one wallet
- Effortless Asset Management: Monitor and transact seamlessly with Trezor Suite, our intuitive desktop and mobile app
- Enhanced Backup Solution: Rest assured with Multi-share Backup, eliminating single points of failure for secure cold wallet recovery
The notice also covered operators who could not upgrade straight away. For that case it recommended the following steps:
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →- Restart
lightningdwith the--offlineflag. This stops peers from sending messages to the node while the daemon still processes the blockchain. - Upgrade to v26.06.7 as soon as practical.
- Remove the
--offlineflag and restartlightningdafter the upgrade.
This interim step is specific to the v26.06.7 notice. It is not a general mitigation for later issues, and operators on v26.06.8 or v26.06.9 should follow the guidance in the release notes for those versions.
Rank #3
- Unparalleled Security: Protect your assets with EAL 6+ Secure Element, offering robust defense and complete transparency
- Simple & Secure Interface: Manage your digital assets easily with a clear OLED screen for secure on-device confirmations
- Supports 1000s of Coins & Tokens: Securely handle thousands of assets, including Bitcoin, Ethereum, and more, all in one wallet
- Effortless Asset Management: Monitor and transact seamlessly with Trezor Suite, our intuitive desktop and mobile app
- Enhanced Backup Solution: Multi-share Backup eliminates single points of failure for secure cold wallet recovery
The v26.06.7 source code was published on September 11, 2026, fourteen days after the August 28 announcement, which matches the delay Blockstream had described. The official release page documents the tarball installation and restart process. Database migrations run automatically at startup, so no separate migration command is required.
Docker image incident in v26.06.7
The official v26.06.7 release page records a Docker problem. Between August 28, 2026 at 16:04 UTC and September 1, 2026, the Docker tags for that release served incorrect images. The project has published corrected digests. Operators who pulled a v26.06.7 image in that window should:
Rank #4
- Dual-chip architecture for maximum protection: The next-gen, fully auditable TROPIC01 chip works alongside a certified EAL6+ Secure Element—completely NDA-free—to deliver radically transparent, industry-leading defense against physical attacks.
- Quantum-ready security: Get protection against future threats with the first-ever hardware wallet designed with quantum-ready architecture.
- See every detail with confidence: Our largest high-resolution color touchscreen makes it easy to navigate your assets, review transactions and manage your coins with clarity.
- Wireless freedom with encrypted Bluetooth control: Manage, buy, swap and stake securely using Trezor Suite on desktop or mobile. Qi2-compatible wireless charging keeps your Trezor powered up. No cables required—security meets convenience.
- Works seamlessly with Android, iOS and desktop: Connect wirelessly or via USB-C to your phone or computer. Manage your crypto anywhere with our companion Trezor Suite app.
- Compare the image digest against the corrected digest listed on the official release page.
- Re-pull the image if the digest does not match.
- Copy digests only from the official release page, not from forum posts or third-party mirrors.
Operators pinned to v26.06.6 or earlier were not affected by the incorrect v26.06.7 tags, according to the same page. The release page also notes reproducibility limits for some architectures and build targets. Those limits are specific to that release, so check the page for the platform you run.
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchEarlier denial-of-service flaw for inbound channels
Bitcoin Optech reported on May 29, 2026 a denial-of-service vulnerability that affected nodes accepting incoming channels. During the channel-opening handshake, a peer could send an all-zero funding transaction ID. That input triggered an assertion failure and crashed the node. Optech states the flaw was fixed in Core Lightning v26.04.
Best Value
- Effortlessly build your crypto portfolio via the all in one Ledger Wallet app: buy, sell, send, receive, swap, stake and more across popular blockchains. 15,000+ coins & tokens in a single dashboard. Keep a close eye on the market. Compare service providers. Track performance. Get timely alerts. Build your portfolio with confidence.
- Effortlessly build your crypto portfolio via the all in one Ledger Wallet app: buy, sell, send, receive, swap, stake and more across popular blockchains. 15,000+ coins & tokens in a single dashboard. Keep a close eye on the market. Compare service providers. Track performance. Get timely alerts. Build your portfolio with confidence.
- Enjoy Bluetooth connectivity, iOS access, and hours of battery use with this mobile-first, secure backup signer. Freedom you can depend on.
- Genuine Check: confirm your signer is authentic during setup with the Ledger Wallet app.
- Protect your signer: keep it in mint condition at all times with a bespoke Pod or Case to avoid scratches and everyday wear and tear.
This issue is separate from the v26.06.8 fixes and from the payment bug in the headline. Nodes running v26.04 or later already include the fix, according to Optech. Operators still on an earlier release should upgrade for this reason alone.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Version 26.06.9: a secondary report
A release-history entry from Freedom.Tech lists Core Lightning v26.06.9, dated October 7, 2026. That entry describes security fixes from responsible disclosures and a fix for a gossip regression that was introduced in v26.06.8. It does not describe a Bitcoin payment bug.
The v26.06.9 information comes from a secondary tracker, not from an official release record that this article has verified. Treat the description as a lead. Before updating to v26.06.9, check the official Core Lightning release page for its release notes and install instructions.
How the issues compare
The table below separates the items by type and by source. Where the evidence does not state a value, the cell says so.
| Release or issue | Date | Type | Fix or guidance | Source |
|---|---|---|---|---|
| v26.06.7 security update | Notice August 28, 2026; source published September 11, 2026 | Security update | Upgrade; interim --offline restart while upgrade is pending |
Blockstream notice; official release page |
| v26.06.7 Docker tags | Incorrect images served August 28, 2026 16:04 UTC to September 1, 2026 | Distribution error | Compare digest against corrected digest; re-pull on mismatch | Official release page |
| Inbound-channel denial of service | Reported May 29, 2026 | Denial of service (assertion crash on all-zero funding transaction ID) | Fixed in v26.04 | Bitcoin Optech |
| v26.06.8 | September 22, 2026 | Bug fixes and responsibly reported vulnerability fixes | Upgrade; individual vulnerabilities not described | Official release record |
| v26.06.9 | October 7, 2026 | Security fixes and a gossip regression fix (reported) | Not stated in official notes available to this article | Freedom.Tech release tracker (secondary) |
Which path to take
- Running v26.04 or later: you already have the inbound-channel fix. Move to v26.06.8 or the newest official release for the security fixes.
- Running v26.06.7 from a Docker tag pulled between August 28 and September 1, 2026: verify the digest against the official release page before anything else.
- Running a release older than v26.04: upgrade promptly. The inbound-channel crash is fixed from v26.04 onward.
- Unable to upgrade immediately: apply the v26.06.7
--offlinestep only if you are on the version that notice covers, and remove the flag after upgrading.
When you upgrade, install the new tarball or image, restart lightningd, and confirm the version reported by the daemon matches the release you intended.
Quick Recap
“
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
