TFTC on Nostr: Core Lightning's security release shipped broken Docker images. v26.06.7 contains ...

Core Lightning's security release shipped broken Docker images.

v26.06.7 contains fixes for responsibly disclosed vulnerabilities. Source and technical details are being held for 14 days to give operators time to patch before attackers get a roadmap.

The signed tarballs are the release. Operators can verify checksums and maintainer signatures now. Source inspection and reproducible builds come later.

But the Docker images automatically published under elementsproject/lightningd:v26.06.7 and latest reported the correct version on startup without actually containing the security fixes. A version label is not an artifact.

Operators should use the signed tarballs, verify the signatures, restart lightningd, and not treat the current Docker tag as an upgrade while the warning remains on the release page.

Core Lightning says AI models are increasing the number and speed of security reports its maintainers must triage. Cheaper bug discovery means more reports for maintainers and more tools for attackers. Release integrity and operator verification become the bottlenecks.

A fix only matters if operators can verify that it reached the artifact they installed.