Unpatched Bitcoin Lightning nodes face channel-draining bug
Summary
Core Lightning released v26.06.10 to fix Bitcoin Lightning channel-security, payment-resolution and remote-command vulnerabilities. Changes include validating peer signatures and dust limits during channel opening and splicing, correcting handling of removed HTLCs, and closing commando rune-restriction bypasses and crash or resource-exhaustion issues. Maintainers urge operators to upgrade promptly and audit remote-command credentials, restrict runes to known node IDs, and revoke credentials they cannot account for. Tests for the security fixes are temporarily withheld to slow exploit development. Dual funding remains experimental, and operators are advised against zero-confirmation channels with untrusted peers.
