Lightning's Two Main Implementations Disclose Critical Flaws in the Same Week

LND disclosed a channel-close flaw whose reproduced worst case can expose a channel's full balance — requiring a malicious peer, a one-block reorganisation and an old revoked state; the official fix ships in 0.21.0, leaving earlier standard releases unprotected, and coverage noted the fix landed later than disclosure suggested. Separately, Core Lightning confirmed multiple critical vulnerabilities on Aug 26: an initial offline advisory was superseded by patched releases, with operators urged to upgrade and stay online since a stopped node cannot respond to force-closes. No confirmed losses in either case, per the projects.