What to know

  • Maintainers released 26.06.9 onOctober7 and urge upgrading.
  • The release covers channel, HTLC, access-control and crash fixes.
  • Operators must check plugin permissions and compatibility as well as binary replacement.

The maintainer announcement

Core Lightning released 26.06.9 on 7 October 2026. Its official notes identify security fixes across channel reestablishment, splicing, HTLC handling, authorization and other areas, together with a correction to a gossip CPU-throttle regression in 26.06.8. Maintainers strongly recommend upgrading. The release says detailed security tests are temporarily withheld to give operators time to update, while the fixes themselves are available. BijliCoin is reporting the project’s release notes, not claiming an independent security audit of the patched implementation.

An update can alter legitimate behavior

Security changes are often described as closing a malicious path. They can also affect scripts and integrations that relied on broader privileges than intended. Our interpretation is that an operator should list the actions each plugin or automation performs before updating. A scheduled task might need to read configuration, create an authorization token or manage a channel. Those tasks should be checked against their documented permission requirements rather than solved by granting every integration unrestricted access.

Check availability after the security change

The reported gossip regression is a reminder that resource protection and normal traffic need to be evaluated together. A rate-control feature can have the right defensive goal while still penalizing ordinary activity. After an upgrade, useful checks include peer connectivity, expected message flow, payment handling and the absence of unexpected throttling. Establish a short baseline before the change so the operator has something concrete to compare. A clean startup log is only one part of that evidence.

Plan the change around channel state

A Lightning node contains persistent state whose recovery procedures matter as much as the executable. Operators should use the project’s current backup guidance and understand supported upgrade paths before replacing software. A rollback plan must account for any state or schema changes; it cannot simply assume an older binary can reopen everything written by a newer one. This article deliberately avoids a universal shell command because different packaging, databases and hosting arrangements create different recovery boundaries.

Keep the assurance claim narrow

Installing the recommended release addresses the fixes shipped by that release. It does not prove that every plugin, RPC exposure or operating-system configuration is secure. The next useful record is an operator’s own version verification and bounded service checks, without sharing secrets or channel backups. Readers should use the signed official artifacts and release documentation for their environment. The concrete news is a maintainer-backed update with explicit operational consequences, not a guarantee that a Lightning deployment becomes risk-free after one installation.

Sources and reading

Editorial note: AI-assisted original BijliCoin synthesis. Original BijliCoin synthesis of the linked public primary source. Defensive recommendations are editorial interpretation, not a claim of hands-on testing. No exploit procedure is provided. Illustration is conceptual.

Sources & context

  1. Core Lightning 26.06.9 official release ↗

See our editorial policy or report a correction.