Blockstream released Core Lightning (CLN) version 26.06.7 to fix confirmed security vulnerabilities and urged operators to install it. For those who could not upgrade right away, the project recommended temporarily taking their nodes offline.
- CLN 26.06.7 fixed confirmed vulnerabilities reported to the project.
- Blockstream delayed publication of the release’s source code for 14 days to give operators time to update.
- Offline mode lets the daemon process Bitcoin’s blockchain while disconnecting it from Lightning peers.
Blockstream’s release notice says it received security reports from the open-source Bitcoin community in early August. Version 26.06.7 fixed vulnerabilities reported over the previous three weeks. The notice does not describe the flaws or say they had been exploited.
Blockstream said releases before 26.06.7 were unsupported and urged operators to install the new version. That statement alone does not mean every earlier release was vulnerable to every flaw fixed in 26.06.7. Operators should check the project’s official release information for guidance on their current setup.
Why the source code was delayed
Blockstream made signed binaries available before publishing the source code. The company said it would publish the source 14 days later, on September 11, 2026, giving operators time to upgrade before attackers could study the fixes.
The delay involves a trade-off. It gives operators time to update before the fixes become public, but it also temporarily limits independent review. Blockstream advised operators to verify the signatures, then rebuild the software after the source code is published and confirm that it matches the installed binary.
What offline mode means for operators
Blockstream advised operators who could not upgrade immediately to restart CLN with the --offline option. The daemon stays active, processing Bitcoin’s blockchain and detecting cheating, but disconnects from Lightning peers. While the node is offline, it cannot send, receive, or route Lightning payments.
Offline mode is a temporary precaution, not a replacement for the update. Blockstream’s instructions were to upgrade, remove the flag, and restart the node before reconnecting to Lightning.
Security reports, confirmed vulnerabilities, attempted attacks, successful exploitation, and stolen funds are separate claims. Blockstream’s 26.06.7 notice confirms that vulnerabilities were fixed. It does not establish that anyone exploited them or lost funds. Operators should check CLN’s official security and release channels for later warnings or upgrade instructions.
Key questions for Lightning operators
-
What did Blockstream recommend in its 26.06.7 notice?
It advised operators to install 26.06.7 and said earlier releases were unsupported. Check CLN’s official release information for later guidance and the version recommended for your setup.
-
Does the notice confirm successful attacks or fund losses?
No. It confirms that vulnerabilities were fixed, but does not say they were exploited or that users lost funds.
-
Can a node make Lightning payments in offline mode?
No. The daemon can keep processing Bitcoin’s blockchain, but it disconnects from Lightning peers and cannot send, receive, or route payments.
-
When should an operator reconnect after using offline mode?
Blockstream advised operators to upgrade first, then remove the offline flag and restart the node before reconnecting to Lightning.
Blockstream’s broader efforts to expand Bitcoin access include a new Tokyo office and partnerships. The company has also supported crypto custody, including Bitcoin financing for Komainu.
The security reports also included AI-assisted vulnerability reports. The reports are a reminder to assess findings carefully rather than treat every report as proof of a successful attack.
