Core Lightning channel security fixes

What happened

Core Lightning maintainers released security fixes on November 4, 2026, and urged operators to upgrade.

What changed

Maintainers corrected channel funding, splicing, payment resolution and remote access vulnerabilities.

What did not change

Maintainers continue to classify dual funding as experimental and discourage trusting unknown peers with unconfirmed channels.

Confirmed

• Maintainers included signature checks for channel transactions and fixes for resolving conditional payments on-chain.
• Maintainers temporarily withheld security tests to give operators more time to upgrade.
• Maintainers recommended restricting remote access credentials and replacing credentials that operators cannot account for.

Still open

• Maintainers did not establish losses or exploitation in this release notice.
• The notice does not establish which service providers have installed the fixes.

What it means for an advisor

• Ketju should review the Lightning memo's node security and channel settlement requirements.
• Ketju should confirm affected providers' upgrade status before relying on their payment services.