Core Lightning ⚡️

Blockstream

@Core_LN

The community Lightning Network implementation bringing instant, low-cost, global micropayments to Bitcoin.

Layer-2 github.com/elementsprojec… Joined May 2019

291 Following 13K Followers 1.4K Posts

Latest posts 5

Pinned post

Core Lightning ⚡️ @Core_LN 5d

Core Lightning 26.06.10 is out, and every node runner should upgrade.

This point release includes security fixes. Verify the signatures and install it as soon as possible.

github.com/ElementsProjec…

github.com Release v26.06.10 Quantum-Resistant Lightning Channel VII · ElementsProject/lightning This 26.06.10 point release includes fixes for vulnerabilities responsibly reported by a number of sources, alongside a set of bug fixes. We strongly recommend upgrading to this release. As with 26...

Core Lightning ⚡️ @Core_LN Oct 22

CLN users: older versions of the webpki-roots dependency (RUSTSEC-2026-0381) still trust compromised emSign intermediate certificates, which may expose HTTPS requests to potential MITM attacks.

Core CLN code and the Lightning protocol are unaffected. The vulnerability is limited to the currencyrate (cln-currencyrate) plugin, which is enabled by default. Exposure is possible when:

- Using commands provided by the currencyrate plugin
- Configuring bkpr-currency for the bookkeeper plugin

The BIP353 plugin is unaffected in practice. Its upstream dependency includes an LNURL fallback path that uses HTTPS, but CLN's BIP353 plugin relies on DNS resolution and ignores the LNURL fallback result, so the affected TLS certificate validation path is not used.

If you don't need currencyrate, disable it by adding this to your CLN configuration: disable-plugin=cln-currencyrate

A fix is pending the relevant upstream dependency updates and a subsequent CLN release. Nodes not using the affected currencyrate functionality are not expected to be exposed, even with the plugin enabled.

Core Lightning ⚡️ @Core_LN Oct 7

Core Lightning 26.06.9 is out. Upgrade now.

It fixes a newly reported vulnerability that can lead to loss of funds. Nodes running 26.06.8 or earlier are affected.

Verify the signatures and install it as soon as possible.

github.com/ElementsProjec…

github.com Release v26.06.9 Quantum-Resistant Lightning Channel VI · ElementsProject/lightning This 26.06.9 point release includes a set of bug fixes alongside fixes for vulnerabilities responsibly reported by a number of sources, and fixes a gossip regression introduced in 26.06.8. We stron...

Core Lightning ⚡️ @Core_LN Oct 2

Urgent security update: If you’re running version 26.06.7 or earlier, please upgrade to the latest release as soon as possible.

We’ve received reports that attackers are targeting unpatched nodes. Keeping your node up to date is an important step in protecting your funds.

Core Lightning ⚡️ Verified account @Core_LN Sep 24

Core Lightning 26.06.8 is out, and every node runner should upgrade.

This release fixes vulnerabilities responsibly reported over recent weeks. There is no embargo period: the release and fixes are available right now.

A number of tests are being held back temporarily to make the underlying issues harder to reverse-engineer while node runners have time to upgrade.

Please upgrade as soon as possible.

github.com/ElementsProjec…
View quoted post on X

Core Lightning ⚡️ @Core_LN Sep 30

cln-application 26.09 is out.

It moves the app to Node 22, adds optional native HTTPS and reverse-proxy support, and tightens how passwords, sessions, and settings are handled. We recommend upgrading.

github.com/ElementsProjec…

github.com Release Release v26.09 · ElementsProject/cln-application cln-application 26.09 This release moves the application to Node 22, adds optional native HTTPS and reverse-proxy support, tightens how settings, passwords and sessions are handled, and modernises ...