Core Lightning releases 26.06.9 security update
The release hardened channel-state handling, payment resolution and access controls in a production Lightning implementation.
Core Lightning released version 26.06.9 on October 7, 2026, addressing security and reliability issues affecting channel state, HTLC resolution and access control.
Hash time-locked contracts coordinate conditional payments across Lightning channels. Implementations must account for payments consistently as messages arrive, channels close and transactions settle on Bitcoin. Errors at those boundaries can affect more than an application's convenience: they can interfere with the node's ability to resolve its financial position correctly.
The update also addressed boundaries around access to the node. That placed operational permissions alongside protocol-state handling in the security work required to run Lightning infrastructure.
The release was a software remediation stage, not an activation of new Bitcoin consensus rules. Its availability did not establish that the entire network had adopted it, but it provided operators with corrected software for the affected implementation.