A claim that Core Lightning v26.06.9 includes security and payment fixes is not supported by the project’s release notes available for verification. The official notes cover v26.06.8, which fixes responsibly reported vulnerabilities, but do not mention payment-related changes.
- Version confirmed in release notes: v26.06.8, not v26.06.9.
- Security: The v26.06.8 notes recommend upgrading and describe fixes for responsibly reported vulnerabilities.
- Payment fixes: Not specifically documented.
Core Lightning (CLN) is software for running a node on the Bitcoin Lightning Network. Payment channels let users transact without recording every payment directly on Bitcoin’s blockchain. For node operators, both security and reliable payments matter. But a version number and a broad claim about fixes do not tell you what changed.
What Core Lightning’s Release Notes Confirm
The official v26.06.8 release notes describe bug fixes, including fixes for vulnerabilities reported responsibly by multiple sources. They strongly recommend upgrading. The notes do not identify the vulnerabilities, rate their severity, or explain which configurations or components may be affected.
The notes also say some tests were temporarily withheld to make it harder for potential attackers to identify and exploit the underlying issues while users had time to update. The release and its fixes were available immediately, with no embargo period. In other words, the software was released without delay, while some technical details were held back. That choice signals caution, but does not establish how severe any individual vulnerability was.
The notes do not describe the fixes specifically as payment fixes or say whether they affect payment success, routing, or another part of Lightning operations. Calling them “payment fixes” goes beyond what the release notes confirm.
Don’t Install an Unverified Version Claim
The official release material cited here covers v26.06.8, not v26.06.9. That does not prove v26.06.9 does not exist. It means the version and its claimed fixes are not substantiated by the release information available here. No publication date or additional official details for v26.06.9 are established.
Operators should not install software based only on an unverified version claim. Check the Core Lightning release page for the exact version and follow the instructions for that release.
Upgrades also need care. They can change a node’s database, and downgrading may not be possible afterward. The v26.06.8 notes specifically warn that nodes that have run development builds from the master branch cannot downgrade to a 26.06.x release because the database schema is newer. This is a practical warning about release compatibility, not a special requirement confirmed for v26.06.9.
Key Questions for Node Operators
-
Is Core Lightning v26.06.9 confirmed?
Not in the official release notes available here, which identify v26.06.8. That does not establish that v26.06.9 does not exist.
-
What security fixes are confirmed?
The v26.06.8 notes say it fixes responsibly reported vulnerabilities and recommend upgrading. They do not disclose the vulnerabilities or their severity.
-
Are payment fixes confirmed?
No. The notes mention bug fixes but do not specifically identify payment-related changes.
-
What should operators do before upgrading?
Verify the exact version on Core Lightning’s official release page and follow its release-specific instructions. Consider the database compatibility warning, especially if the node has run a development build.
For now, operators can rely on the documented v26.06.8 security recommendation, but should verify any newer version and its release notes before installing it. Security updates deserve prompt attention. Unverified version numbers do not. See Core Lightning’s previous warning about patching Lightning Network security flaws and Blockstream’s call for Core Lightning operators to upgrade.