Four Core Lightning Docker tags served unpatched binaries while reporting version v26.06.7 at startup, affecting the v26.06.7, latest, v26.06.7-vls and latest-vls tags distributed between Aug. 28 at 16:04 UTC and Sept. 1. Node operators must verify their image digest against the corrected values to confirm the security patch was properly installed. The maintainers have replaced the faulty images, though source code disclosure is embargoed until Sept. 11, giving operators a narrowing window to upgrade before fixes become publicly available. The corrected digest for standard versioned images is sha256:0421a5f0d1b2e1ad639edfa17d777816040e3850d91bae7f2d32186d9c1e6da4, and sha256:6a5e05c13a65613f8c0fe3830c60248a6724e7206c1c23dd26ac2e98a3e72c1f for VLS tags.
Source: Read the original article
