Core Lightning 26.06.9 is a security update Bitcoin Lightning node operators should not ignore. Maintainers are urging users to upgrade after fixing multiple vulnerabilities and a regression in the previous release that could delay channel traffic.

What Changed?

The release includes security fixes across channel reestablishment, splicing, HTLC handling during shutdown, onion processing, on-chain handling, gossip range queries, access-control runes and configuration operations. Maintainers also corrected a CPU-throttling regression introduced in version 26.06.8: busy nodes could count ordinary gossip, pings and onion messages against a peer budget, delaying channel traffic. Version 26.06.9 limits that budget to gossip queries.

These are not merely cosmetic changes. Lightning nodes maintain payment channels, route messages and enforce authorization rules. Bugs in those paths can affect reliability and security even when the Bitcoin blockchain itself is operating normally.

Why Operators Should Care

The project says it temporarily withheld tests for the security fixes to reduce the risk of turning those fixes into working exploits before operators have time to upgrade. That does not mean a specific exploit has been observed in the wild. It means maintainers consider the issues serious enough to recommend prompt action.

Node operators should read the official release notes, back up their configuration and recovery information using their established procedures, verify the downloaded release signatures and checksums, and plan a controlled upgrade. Test critical integrations after restarting.

New Signed Builds for ARM Devices

The release also introduces reproducible ARM64 and ARMv7 binaries for supported Ubuntu versions, alongside AMD64 builds. Separate signed checksum manifests are provided for each architecture. That matters for operators running Lightning infrastructure on compact, low-power hardware as well as conventional servers.

What This Does Not Mean

This release is not a Bitcoin consensus upgrade and does not change Bitcoin’s 21-million-coin supply limit. It is a maintenance and security update for Core Lightning, one implementation of the Lightning Network. Operators using other Lightning implementations should follow their own projects’ advisories.

SmartNews Takeaway

Open-source Bitcoin infrastructure needs maintenance as much as innovation. Core Lightning 26.06.9 illustrates how a small-looking point release can contain important fixes for security, network traffic and deployment hardware. The immediate story is straightforward: operators running Core Lightning should review the advisory and upgrade as soon as practical.

Sources: Core Lightning v26.06.9 official release and Bitcoin Optech Newsletter #426.