CommitWatch RSS
Continuous public-repository analysis

Open source.
Not open secrets.

We watch what security-critical projects change—then translate the code into clear, independent intelligence anyone can understand.

Explore the watch feed ↓See how scoring works →
34Projects watched
24903Commits captured
21206AI analyses
53High-risk findings · 30d
Active security advisories
Critical

Core Lightning v26.06.9: urgent loss-of-funds security update

Core Lightning says v26.06.9 fixes a newly reported vulnerability that can lead to loss of funds. The release also contains security fixes in channel reestablishment, splicing, HTLC shutdown handling, onion and on-chain handling, gossip range queries, runes, configuration, and several remote-crash and hardening fixes.

Affected: Every Core Lightning node running v26.06.8 or earlier is affected, according to the vendor. Technical tests for the security fixes are temporarily withheld to slow exploit development while operators upgrade.

Action: Upgrade to Core Lightning v26.06.9 immediately. Download the release from https://github.com/ElementsProject/lightning/releases/tag/v26.06.9, verify the appropriate signed SHA256 manifest and checksums for your architecture, install it, restart lightningd, and confirm the running version.

Read source ↗
Critical

Liquid Network: ~4,000 BTC withdrawn in critical peg incident

Liquid confirms that purported white-hat actors withdrew roughly 4,000 BTC (about $320 million) from its federation wallet through the SideSwap PAK. Liquid says the PAK and other federation keys were not compromised. The actors have not yet returned the funds. Independent public analysis points to a newly introduced range-proof cache-key flaw, but Liquid has not yet published its root-cause report.

Affected: The L-BTC peg and Liquid federation reserves are affected. Bridge nodes are disabled, the sidechain is paused, and exchanges have suspended L-BTC deposits and withdrawals. Liquid says other issued assets, including USDT, DePix, and RWAs, are unaffected; Bitcoin's base layer is not affected.

Action: Do not initiate Liquid peg-ins, peg-outs, swaps, or L-BTC exchange deposits or withdrawals while the network is paused. Follow official Liquid and Blockstream updates, and treat L-BTC peg exposure as impaired until reserves are restored and a verified fix and incident report are published.

Read source ↗
Critical

BTCPay Server: actively exploited LND credential theft

BTCPay confirms that an unauthenticated remote attacker could obtain LND .macaroon credentials, take control of affected LND nodes, and move funds. The vendor reports confirmed exploitation and stolen funds.

Affected: BTCPay Server versions before 2.4.2, including 2.4.2 release candidates, when used with LND. BTCPay says other Lightning implementations are not exposed to this specific credential risk.

Action: Update to BTCPay Server 2.4.2 and LND 0.21.1 immediately, review node activity, and rotate credentials. If you cannot update now, take the affected server offline.

Read source ↗
The watch feed

Changes worth understanding

AI analysis is published as generated. Community notes appear after human validation.

21206 analyses
Highest risk·RSS
Moderate 59 AI analysisMessage 45 · Thin
XMR Monero ProjectMonero Cryptographic librariesMoneroNode implementationsPrivacy protocols

wallet2: reject malformed multisig_info on import

This Monero wallet update adds safety checks when a multisig wallet imports data shared by other signers. Before, the code trusted the size and claimed signer of imported multisig data too much; now it rejects blobs with the wrong number o…

Input validation added to multisig import pathMismatch between header signer and body signer now rejectedUnexpected vector lengths in imported multisig data now rejected
3f7dc4ebby jpk68+120−02 files
No security note in commit
Open full analysis →Source commit ↗
Moderate 56 AI analysisMessage 50 · Thin
XMR Monero ProjectMonero Cryptographic librariesMoneroNode implementationsPrivacy protocols

multisig: reject mismatched key image component count

This Monero commit hardens the multisig wallet code that combines partial key images from multiple signers. Previously, the code could silently build an incomplete or wrong composite key image if it received too few, too many, or duplicate…

Defensive validation added to multisig key-image compositionRejection of duplicate and identity partial key imagesRejection of reused signing nonces (m_L) in imported multisig data
3125e6d8by jpk68+133−206 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 96 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Merge rust-bitcoin/rust-bitcoin#6839: build(deps): bump astral-sh/setup-uv from 8.2.0 to 8.3.2

This is a routine update to a GitHub Actions helper used to install a Python tool called uv during automated security scanning workflows. It only changes the pinned version of that helper from 8.2.0 to 8.3.2 in two workflow files. There is…

No security-relevant signal: routine dependency bump in CI toolingWorkflows affected are security scanners (zizmor), not production codeNo CVE, advisory, or vendor security statement present in commit or references
3434d8e6by Andrew Poelstra+2−22 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 100 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Merge rust-bitcoin/rust-bitcoin#6842: build(deps): bump github/codeql-action/upload-sarif from 4.36.2 to 4.37.0

This is a routine update by Dependabot of a GitHub Actions helper used to upload security scan results. The change only swaps one pinned version of the official GitHub CodeQL action for a newer one in a scheduled workflow. It does not alte…

36a72fefby Andrew Poelstra+1−11 file
No security note in commit
Open full analysis →Source commit ↗
Moderate 51 AI analysisMessage 50 · Thin
XMR Monero ProjectMonero Cryptographic librariesMoneroNode implementationsPrivacy protocols

cryptonote_protocol: reject conflicting span reservations

This Monero code change fixes a bookkeeping bug in how the node keeps track of which blockchain chunks (called 'spans') it has already asked other nodes to download. Before the fix, the code could reserve the same span twice for different …

Conflicting resource reservation preventedP2P protocol state inconsistency mitigatedUnit tests added for conflict and prefix-skip behavior
9cef02d9by selsta+65−43 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 93 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

build(deps): bump github/codeql-action/upload-sarif

This is a routine update by Dependabot to the GitHub CodeQL upload-sarif action used in a scheduled security-scanning workflow. It changes only the pinned commit hash for the action from version 4.36.2 to 4.37.0. There is no indication thi…

8d5a2f95by dependabot[bot]+1−11 file
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 93 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

build(deps): bump actions/labeler from 6.1.0 to 6.2.0

This is a routine automated update by Dependabot that bumps the GitHub Actions 'labeler' workflow dependency from version 6.1.0 to 6.2.0. The labeler action only manages pull-request labels; it does not touch source code, build artifacts, …

cf7dd140by dependabot[bot]+1−11 file
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 93 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

build(deps): bump taiki-e/install-action from 2.82.7 to 2.82.11

This is an automated update by Dependabot that bumps a third-party GitHub Action used in the project's CI workflows from version 2.82.7 to 2.82.11. The action installs developer tools during automated testing. There is no indication in the…

798bf107by dependabot[bot]+2−22 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 93 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

build(deps): bump astral-sh/setup-uv from 8.2.0 to 8.3.2

This is a routine automated update by Dependabot that changes the pinned version of a GitHub Action used to install a Python tool called 'uv' in two workflow files. The action is referenced by a fixed commit hash (a 'pin'), which is a secu…

2427fa6aby dependabot[bot]+2−22 files
No security note in commit
Open full analysis →Source commit ↗
High 71 AI analysisMessage 68 · Adequate
XMR Monero ProjectMonero Cryptographic librariesMoneroNode implementationsPrivacy protocols

tx/partial tx validation hardening

This Monero wallet commit adds stronger safety checks when handling unsigned, partially signed, and fully signed transactions before they are signed or broadcast. It prevents several risky situations: reusing the same coin across multiple …

Prevention of duplicate input pubkeys across transaction sets (avoids double-spend / same-input reuse within a set)Change-address ownership validation for unsigned transactions (prevents change theft / misdirected change)Transaction-set amount validation: outputs <= inputs and change <= change-address payments (prevents value inflation / inconsistent accounting)
1c7ba697by koe+265−454 files
Vendor flagged security relevance
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 91 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Merge rust-bitcoin/rust-bitcoin#6837: Automated nightly rustfmt (2026-09-06)

This is an automated code-formatting commit. It only changes how two import lines and one function are written, with no effect on what the program actually does. There is no security relevance.

3a9f9241by Andrew Poelstra+2−51 file
No security note in commit
Open full analysis →Source commit ↗
Low 36 AI analysisMessage 58 · Thin
BT BTCPay ServerBTCPay Server BitcoinLightning NetworkPayment infrastructure

Encode payjoin errors in wallet status messages (#7567)

This commit fixes a potential cross-site scripting (XSS) issue in BTCPay Server's wallet status messages. When a payjoin transaction fails, the server shows a warning message that includes an error string. Previously, that error string was…

HTML content constructed from an external error string without encodingAddition of HtmlEncoder.Default.Encode around user-influenced or third-party error textStatus message rendered as raw Html in the UI
a60f8bf2by Nicolas Dorier+2−11 file
No security note in commit
Open full analysis →Source commit ↗
01
Why commit watching?

Security should leave a paper trail.

A quiet fix may be responsible caution—or it may leave users unaware that their assets were ever at risk. CommitWatch preserves the evidence, adds context, and tracks whether vendors disclose, acknowledge, and learn.

Why we built this →