Optech #426: Core Lightning, LDK and BTCPay patch Lightning vulnerabilities

Serguey Asael Shinder10 October 2026, 09:462 min read

Bitcoin Optech's newsletter #426, published on 9 October, is unusually heavy on security releases. If you run Lightning infrastructure, several of these are upgrade-now items.

Security releases:

• Core Lightning 26.06.9 fixes vulnerabilities in channel reestablishment, splicing, HTLC handling and access controls, and a regression in 26.06.8 that could delay channel traffic by wrongly throttling peers. Tests for the security fixes are temporarily withheld to make exploitation harder; the source is available now, and the project strongly recommends upgrading.
• LDK v0.2.7 and v0.1.13 include a channel-reestablishment funds-theft fix and a DoS fix for Electrum-based sync. Optech describes the bug (LDK #5057): a malicious peer could falsely claim at reconnection that it missed a commitment it had already acknowledged; LDK could then sign a new valid commitment without recording it, and fail to claim the incoming HTLC of a forwarded payment. 0.2.7 also fixes an LSPS2 just-in-time channel bug where an LSP trusted the payer's requested forwarding amount without checking the incoming HTLC, letting a payer make the LSP cover the difference.
• BTCPay Server 2.4.5 now blocks private-network destinations by default for outbound HTTP used by Lightning connections, LNURL, notifications and webhooks — closing a server-side request forgery path — and tightens invoice and refund permissions. Its Docker changes make Tor opt-in, including for existing deployments, so check your setup after upgrading.

Bitcoin Core fixes (merged, not yet released):

• #36277 closes a transaction-origin privacy leak in the experimental opt-in private broadcast feature, where an attacker controlling one private-broadcast peer could relay the transaction back and watch which pending connection closed.
• #36338 fixes silent payments (BIP352) scanning that could miss payments when an input contained a crafted but consensus-valid P2PKH scriptSig.
• #36365 makes the combined fee estimator fall back to the confirmation-based estimate when the mempool estimator is unavailable.

Releases to test: Bitcoin Core 32.0rc3 and LDK v0.3-rc3 (which negotiates anchor channels by default and invalidates previously issued BOLT11 invoices with payment metadata).

Also this week: Anthony Towns posted a draft BIP letting peers choose their own one-byte message IDs over the BIP324 v2 transport, and a proposal for a privacy metaprotocol called Shielded Bitcoin drew discussion on Delving Bitcoin.

Source: Bitcoin Optech Newsletter #426, 9 October 2026 — https://bitcoinops.org/en/newsletters/2026/10/09