Core Lightning Fixes Critical Flaw in Channel Management

• •A flaw in Core Lightning allowed old channel states to be broadcast without penalties.
• •Operators must update to at least v26.06.8 to mitigate the risk.
• •Docker users need to verify image digests to ensure they have the correct version.

Core Lightning has patched a significant flaw in its v26.06.7 release that allowed a peer to broadcast an old, revoked channel state without incurring penalties for cheating. This vulnerability could be exploited if a peer did not specify an upfront shutdown script when opening a channel, enabling them to present a revoked commitment as legitimate. The fix, detailed in Bitcoin Optech's report from September 25, 2026, checks transaction locktime and sequence encoding to prevent such exploits. Operators using versions older than v26.06.7 are urged to update to v26.06.8, which includes additional security fixes. Docker users must verify their image digests due to a previous issue where the images reported the new version but lacked the necessary fixes. The vulnerability is specific to Core Lightning's channel management and does not affect Bitcoin's base-chain rules.