Core Lightning’s v26.06.8 release includes fixes for responsibly reported security vulnerabilities and other bugs, and its official release notes recommend upgrading. Those notes do not identify the individual vulnerabilities or the Bitcoin payment bug named in the headline. If you operate a Core Lightning node, check your installed version and use the release information for your deployment method before updating.
What Core Lightning v26.06.8 fixes—and what is not disclosed
The official Core Lightning v26.06.8 release notes, dated September 22, 2026, describe a point release containing ordinary bug fixes and fixes for vulnerabilities reported responsibly. They recommend upgrading. The notes retrieved here do not name those vulnerabilities, explain their technical effects, or identify a separate Bitcoin payment bug. They also provide no affected-version range, severity rating, exploitation information, or estimate of funds at risk.
The notes say the release had no embargo, but a small number of tests were temporarily withheld to make reverse-engineering the vulnerabilities harder. That disclosure does not supply the missing details about the payment bug, so operators should not assume a particular payment failure or fix version based on the headline alone.
Should you update your node?
If you operate Core Lightning, treat the v26.06.8 release’s upgrade recommendation as the practical guidance available for that release. First identify the version you are running, then follow the official release instructions appropriate to your installation—especially if you deploy through Docker, where image tags and digests matter. The available notes do not establish a universal interim mitigation for v26.06.8.
#1 Best Overall
- BITCOIN EXCLUSIVE, PHONE VERIFICATION: Bitkey is designed from the ground up exclusively for bitcoin — a dedicated hardware wallet for secure bitcoin storage. Approve transactions with a tap using your phone and NFC. No device screen is required.
- SELF-CUSTODY, NO EXCHANGE OR CUSTODIAN REQUIRED: You hold two of the three keys in the Bitkey system – one on your phone and one on your Bitkey device. The third is stored on Bitkey’s server and cannot move your bitcoin on its own.
- NO SEED PHRASE: Set up and use Bitkey without creating or storing a seed phrase.
- 2-of-3 MULTISIG: Three keys are stored separately across your phone, Bitkey device, and Bitkey’s server. Any two keys are required to move your bitcoin.
- BUILT-IN RECOVERY: Encrypted backup and recovery tools can help you regain access if you lose your phone or Bitkey device. You can also designate a Recovery Contact.
Release information for v26.06.7 is also relevant to operators reviewing the upgrade path, but its instructions are specific to that release and should not be generalized to other issues.
Interim guidance for the v26.06.7 notice
In its August 28, 2026 v26.06.7 security update notice, Blockstream recommended upgrading. For operators unable to upgrade immediately, it described restarting with --offline as an interim measure: the flag prevents peers from messaging the node while still allowing the daemon to process the chain. Blockstream advised removing the flag and restarting after upgrading. This was guidance for the v26.06.7 notice, not a general mitigation for the undisclosed v26.06.8 vulnerabilities or the unnamed payment bug.
Rank #2
- Unparalleled Security: Protect your assets NDA-free EAL 6+ Secure Element, offering robust defense and complete transparency
- Simple & Secure Interface: Manage your digital assets easily with a clear OLED screen for secure on-device confirmations
- Supports 1000s of Coins & Tokens: Securely handle thousands of assets, including Bitcoin, Ethereum, and more, all in one wallet
- Effortless Asset Management: Monitor and transact seamlessly with Trezor Suite, our intuitive desktop and mobile app
- Enhanced Backup Solution: Rest assured with Multi-share Backup, eliminating single points of failure for secure cold wallet recovery
Source publication and Docker image checks for v26.06.7
The official v26.06.7 release record says the source code was published on September 11, 2026, 14 days after the August 28 announcement. Its installation notes describe using the tarball and restarting lightningd; database migrations are applied automatically at startup.
The same release record warns that Docker tags served incorrect images between August 28 at 16:04 UTC and September 1. It provides corrected image digests and platform details. If you used a v26.06.7 Docker tag during that window, consult the official release page to check the digest and re-pull if it does not match. Do not rely on a digest copied from a secondary source. The page says users pinned to v26.06.6 or earlier were not affected by the temporary incorrect v26.06.7 tags.
Rank #3
- Unparalleled Security: Protect your assets with EAL 6+ Secure Element, offering robust defense and complete transparency
- Simple & Secure Interface: Manage your digital assets easily with a clear OLED screen for secure on-device confirmations
- Supports 1000s of Coins & Tokens: Securely handle thousands of assets, including Bitcoin, Ethereum, and more, all in one wallet
- Effortless Asset Management: Monitor and transact seamlessly with Trezor Suite, our intuitive desktop and mobile app
- Enhanced Backup Solution: Multi-share Backup eliminates single points of failure for secure cold wallet recovery
Keep the separate v26.04 denial-of-service flaw distinct
An earlier, technically described issue should not be confused with the unnamed payment bug. Bitcoin Optech reported on May 29, 2026, that a peer could send an all-zero funding transaction ID during the channel-opening handshake to a node accepting incoming channels, triggering an assertion crash. Optech reported that the issue was fixed in Core Lightning v26.04. This account provides context for an earlier denial-of-service vulnerability; it does not establish the mechanics, impact, affected versions, or fix for the payment bug in the headline.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.What is known about the later v26.06.9 release
A Freedom.Tech release-history entry dated October 7, 2026, says v26.06.9 addressed security fixes from responsible disclosures and a gossip regression introduced in v26.06.8. This is secondary release-tracker information, not an official v26.06.9 release note in the materials available here. It does not identify the Bitcoin payment bug or establish that v26.06.9 fixes it. Do not treat it as confirmation of a payment-bug fix.
Quick Recap
Best Value
- Effortlessly build your crypto portfolio via the all in one Ledger Wallet app: buy, sell, send, receive, swap, stake and more across popular blockchains. 15,000+ coins & tokens in a single dashboard. Keep a close eye on the market. Compare service providers. Track performance. Get timely alerts. Build your portfolio with confidence.
- Effortlessly build your crypto portfolio via the all in one Ledger Wallet app: buy, sell, send, receive, swap, stake and more across popular blockchains. 15,000+ coins & tokens in a single dashboard. Keep a close eye on the market. Compare service providers. Track performance. Get timely alerts. Build your portfolio with confidence.
- Enjoy Bluetooth connectivity, iOS access, and hours of battery use with this mobile-first, secure backup signer. Freedom you can depend on.
- Genuine Check: confirm your signer is authentic during setup with the Ledger Wallet app.
- Protect your signer: keep it in mint condition at all times with a bespoke Pod or Case to avoid scratches and everyday wear and tear.
Rank #4
- Dual-chip architecture for maximum protection: The next-gen, fully auditable TROPIC01 chip works alongside a certified EAL6+ Secure Element—completely NDA-free—to deliver radically transparent, industry-leading defense against physical attacks.
- Quantum-ready security: Get protection against future threats with the first-ever hardware wallet designed with quantum-ready architecture.
- See every detail with confidence: Our largest high-resolution color touchscreen makes it easy to navigate your assets, review transactions and manage your coins with clarity.
- Wireless freedom with encrypted Bluetooth control: Manage, buy, swap and stake securely using Trezor Suite on desktop or mobile. Qi2-compatible wireless charging keeps your Trezor powered up. No cables required—security meets convenience.
- Works seamlessly with Android, iOS and desktop: Connect wirelessly or via USB-C to your phone or computer. Manage your crypto anywhere with our companion Trezor Suite app.
How to interpret the available release evidence
- Security fixes: v26.06.8’s official notes confirm fixes for responsibly reported vulnerabilities, but do not disclose their individual details.
- Payment bug: The available release notes and tracker information do not establish its technical description, affected versions, financial impact, or fix version.
- Earlier crash issue: The all-zero funding transaction ID denial of service is separately described by Bitcoin Optech and reported fixed in v26.04.
- Deployment checks: Docker users reviewing v26.06.7 should use the official release record’s digest information; tarball users should follow the relevant official installation and verification instructions.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
