Bitcoin payment server with 85 security findings fixed released as version 2.4.7

BTCPay Server released version 2.4.7 on October 29, patching 85 security findings uncovered in a scanner audit, which the project classified as 1 critical, 13 high, 52 medium, and 19 low severity. The fixes address payment processing and accounting data errors, per-store permission flaws, a canceled-payout reopening bug that let users bypass spending limits, cross-store access to another merchant's payment forms and invoice data, and a two-factor authentication rate-limit bypass triggered by concurrent login requests. The project urges operators of servers shared by multiple merchants to update promptly. The release matters because BTCPay Server is self-hosted bitcoin payment infrastructure, so permission and accounting bugs can directly affect merchant funds and invoice integrity. What to watch next is whether shared-hosting operators complete upgrades and whether the scanner's critical and high findings draw further scrutiny of multi-store deployments.