Bitcoin Lightning developers sound alarm over security flaws as second patch lands in five days
Summary
ACINQ released Eclair 0.14.5 on Oct. 20 and urged Bitcoin Lightning node operators to upgrade, warning that malicious peers could exploit some newly patched security flaws. The update can be installed without closing payment channels. It follows version 0.14.4, released five days earlier, which addressed a browser-based attack on Eclair’s administrative API. ACINQ has not disclosed the new flaws’ mechanisms, affected versions, or any confirmed attacks or losses, leaving the exposure of older deployments unclear.
