Core Lightning maintainers are urging users to install version 26.06.10 as soon as possible to address security flaws involving channels, payment settlement and remote command access. The update verifies peer transaction signatures during dual-funded channel opening and channel splicing, in accordance with the BOLT 2 specification. It also prevents a removed HTLC payment contract from being confused with an active contract, which could allow a peer to claim a live payment upstream. Core Lightning says no exploitation has been established, but recommends updating nodes, binding commando authorization credentials to the intended node and replacing credentials that operators cannot account for.
Source: Read the original article
Disclaimer: this content is for information purposes only and is not financial advice. Cryptocurrencies are highly volatile: you may lose all of your capital. Always do your own research. Legal notice
