This point release includes fixes for vulnerabilities responsibly reported by a number of sources. It also comes at a time when increasingly capable AI models are being used to identify potential vulnerabilities in open-source code, significantly increasing the volume and pace of security reports.
The potential impact and associated risks are front of mind for everyone involved, not least the remediation team who have worked tirelessly to triage, resolve, and compile this release.
This embargo period will last for two weeks. The source code will not be published until 14 days have passed. During this time, we strongly encourage everyone to upgrade. At the end of this two-week period, the full release details will be made available.
This delay is designed to reduce the chances of prospective attackers reverse-engineering the fixes and exploiting them before the network can update.
Upgrading
Download the tarball for your platform below, verify it (see next section), then unpack it over your existing installation:
sudo tar -xvf <release>.tar.xz -C /usr/local --strip-components=2Restart lightningd afterwards. No database migration steps are required beyond the automatic ones applied at startup.
Docker users
Docker images are not yet available and will follow shortly after this release. Do not wait for them to upgrade — the tarballs above are the release, and upgrading promptly is the whole point of the embargo period.
Verifying your download
Every binary is covered by a signed manifest. Check the checksums first:
sha256sum -c SHA256SUMS-v26.06.7 --ignore-missingThen the signatures:
gpg --verify SHA256SUMS-v26.06.7.asc SHA256SUMS-v26.06.7SHA256SUMS-v26.06.7 covers the amd64 tarballs and is signed by maintainers. SHA256SUMS-v26.06.7-arm64 covers the arm64 tarballs and has its own signature file. Signing keys:
| Signer | Fingerprint |
|---|---|
| nGoline | 4E4A 142F 8BD3 C38A 56B3 62ED 578C AC08 4725 45C5
|
| Christian Decker | B731 AAC5 21B0 1385 9313 F674 A26D 6D9F E088 ED58
|
| Peter Neuroth | 653B 19F3 3DF7 EFF3 E9D1 C94C C3F2 1EE3 87FF 4CD2
|
| daywalker90 | 8A07 9421 A871 D0B1 0835 1193 7AB4 802E D5A6 39F3
|
Fetch them with gpg --recv-keys <fingerprint>, or from the contrib/keys/ directory of the repository once the source is published.
Reports Received from (No Particular Order)
- erickcestari
- project-loupe
- instagibbs
- benthecarman
- 0xaudron
- callebtc
- haoxucu
- vincenzopalazzo
- ksedgwic
- jaonoctus
- whkim0
- Ahmadsm2005
- labrat-guy
- FrancisPouliot
- Bitcoin Red team
- moinaiagent@coinos.io
The Most Thoughtful Remediation Team
Notes
The "Source code (zip)" and "Source code (tar.gz)" links that GitHub attaches to this release are not the v26.06.7 source. They are generated automatically and cannot be removed. The v26.06.7 source will be published when the embargo ends, 14 days from this release. Do not build from those archives expecting to get these binaries.
A commitment to the source has been published in advance. SHA256SUMS-v26.06.7 includes an entry for clightning-v26.06.7.zip, the source archive, even though that file is not attached to this release. Because the manifest is signed and published today, anyone can confirm when the source appears that it is the same source these binaries were built from, and that nothing was altered during the embargo.
Reproducing the binaries. Full build instructions will accompany the source release. This release was not built with the default optimisation settings, so a standard build will not reproduce these checksums; the exact parameters will be published alongside the source.