Bitcoin Lightning node operators face a new security update after Core Lightning v26.06.10 was released on November 4, 2026. Its maintainers urge users to upgrade promptly following fixes for channel-balance risks, payment settlement, remote commands and several possible crashes. The official release notes confirm immediate availability. Developers temporarily withheld security regression tests to slow the creation of working exploits; the release does not establish that the entire Lightning Network was compromised.

Core Lightning, or CLN, is Blockstream’s open-source software for operating Bitcoin Lightning payment channels. Lightning moves payments across mutually funded channels without placing every transfer directly on Bitcoin’s blockchain. Channel balances, authorization credentials and the eventual on-chain settlement therefore become critical security boundaries.

A 5,000-satoshi ceiling addresses balance losses

The release now refuses channel-opening proposals when a peer requests a dust limit above 5,000 satoshis. It also rejects a dual-funded channel when that limit exceeds the channel reserve. A dust limit determines which tiny outputs are omitted from on-chain closing transactions. Under the previous behavior, the maintainers say a hostile peer could arrange a forced close that converted the operator’s channel balance into transaction fees. The new rule is a CLN channel-validation safeguard, not a new universal Bitcoin dust rule.

Other protections verify counterparties’ transaction signatures during dual-funded openings and channel splices, and repair hashed time-locked contract handling. An expired or recently removed HTLC could previously be mistaken for a live payment with identical identifying fields, causing the upstream payment to be failed even when a peer could still claim funds. Both failures concern settlement correctness, not Bitcoin’s SHA-256 mining process.

Remote credentials need a separate audit

CLN’s commando interface lets a connected application send remote commands to a Lightning node with a permission token called a rune. The new update blocks ways to bypass parameter-name restrictions, reduces denial-of-service exposure from oversized tokens and fixes command-identifier reuse problems that could crash the remote-command service.

The maintainers recommend restricting each commando rune to its intended application’s node ID, reviewing issued tokens and revoking unaccounted-for credentials with blacklistrune. Updating the binary does not automatically identify leaked tokens. Earlier BitcoinVersus.Tech coverage of ZEUS Lightning wallet security updates illustrates why both wallet and node software require attention.

Operators should verify before installing

Version 26.06.10 supersedes v26.06.9, previously covered by BitcoinVersus.Tech. Official downloads include signed checksum manifests for x86-64, ARM64 and ARMv7 builds. Operators should verify the downloaded binary against the appropriate signed manifest, back up the node’s configuration and channel-state recovery material, and then restart through their normal maintenance procedure. Development-branch nodes cannot simply downgrade to 26.06.x because of newer database schemas.

The release also makes plugin-hook failures safer, limits certain gossip-resource costs and adjusts route budgeting for the xpay payment command. Dual-funded channels remain experimental; zero-confirmation channels with unknown peers are discouraged. For operations such as small Bitcoin mining payouts over Lightning, software reliability matters even when the original mining reward was earned on-chain.

Other Bitcoin software incidents are not equivalent. The earlier Bitcoin Core node security report concerns separate vulnerabilities in base-layer software, whereas v26.06.10 fixes one Lightning implementation. The patch list provides no measured estimate of affected balances, confirmed exploitation frequency or network-wide losses.

The practical recommendation is supported by the maintainer’s primary release: install the signed, appropriate v26.06.10 build, review commando permissions and monitor channels after restart. The fixes reduce known risks but cannot replace sound peer selection, liquidity management, backups or ongoing security review.

Editor’s Note: The November 4 release date, 5,000-satoshi peer dust limit, channel and HTLC fixes, rune guidance and binary-verification instructions were verified against the official Core Lightning v26.06.10 release. The earlier v26.06.9 release confirms the material difference from October’s coverage. CryptoSlate’s November 6 reporting provided independent secondary context. No live exploit, industry-wide compromise or precise loss total was independently established. Media use one authentic Blockstream logo and two older official Blockstream YouTube tutorials, with dates and relevance clearly labeled. Saved iframe rendering is not proof of playback; independent mobile/browser checks remain outstanding.

To donate 5,000 sats, display the original QR on another screen and scan it with a compatible Bitcoin wallet. On mobile, use a second display or a wallet’s supported saved-image QR scanner. Verify the payment destination in your wallet before transferring any funds.

We volunteer daily to ensure the information on this platform is Verifiably True. If you would like to support the research, please scan QR code.

BitcoinVersus.Tech is not a financial advisor. Security reporting is informational and not a substitute for testing upgrades, protecting credentials, or independently verifying release signatures.