Lightning Network wallet system LNbits releases 1.7.0 security update

LNbits, an open-source Lightning Network wallet system, released security update 1.7.0 on November 11 and is requiring all operators to upgrade before running their services, after a vulnerability discovered on November 8 was found to affect every prior version and put funds in older releases at risk of theft. The project warned that credentials leaked before the upgrade may still allow attackers to retain access afterward, and advised operators to reset all wallet keys and rotate funding sources and other sensitive credentials. Operators who suspect their server was compromised should install the new version on a fresh server and preserve relevant logs. The update matters because LNbits is widely used tooling for self-custodial Lightning wallets, so any exposure affects node operators and the funds their wallets hold. What to watch next is whether operators complete the upgrade and key rotation promptly, and whether any losses from the pre-patch exposure are disclosed.