Core Lightning patches flaw letting revoked channel states escape penalty
- —Fix shipped in v26.06.7; project recommends v26.06.8 with additional security fixes
- —Flaw required a channel opened without an upfront shutdown script
- —Docker images tagged v26.06.7 from Aug. 28 to Sept. 1 lacked the fixes
- —Patch checks locktime and sequence encoding before matching outputs as a mutual close
Why it matters: Node operators should upgrade promptly: the flaw let peers bypass the penalty for broadcasting a revoked channel state.
Source: CryptoSlate