CommitWatch RSS
Continuous public-repository analysis

Open source.
Not open secrets.

We watch what security-critical projects change—then translate the code into clear, independent intelligence anyone can understand.

Explore the watch feed ↓See how scoring works →
34Projects watched
24904Commits captured
21206AI analyses
53High-risk findings · 30d
Active security advisories
Critical

Core Lightning v26.06.9: urgent loss-of-funds security update

Core Lightning says v26.06.9 fixes a newly reported vulnerability that can lead to loss of funds. The release also contains security fixes in channel reestablishment, splicing, HTLC shutdown handling, onion and on-chain handling, gossip range queries, runes, configuration, and several remote-crash and hardening fixes.

Affected: Every Core Lightning node running v26.06.8 or earlier is affected, according to the vendor. Technical tests for the security fixes are temporarily withheld to slow exploit development while operators upgrade.

Action: Upgrade to Core Lightning v26.06.9 immediately. Download the release from https://github.com/ElementsProject/lightning/releases/tag/v26.06.9, verify the appropriate signed SHA256 manifest and checksums for your architecture, install it, restart lightningd, and confirm the running version.

Read source ↗
Critical

Liquid Network: ~4,000 BTC withdrawn in critical peg incident

Liquid confirms that purported white-hat actors withdrew roughly 4,000 BTC (about $320 million) from its federation wallet through the SideSwap PAK. Liquid says the PAK and other federation keys were not compromised. The actors have not yet returned the funds. Independent public analysis points to a newly introduced range-proof cache-key flaw, but Liquid has not yet published its root-cause report.

Affected: The L-BTC peg and Liquid federation reserves are affected. Bridge nodes are disabled, the sidechain is paused, and exchanges have suspended L-BTC deposits and withdrawals. Liquid says other issued assets, including USDT, DePix, and RWAs, are unaffected; Bitcoin's base layer is not affected.

Action: Do not initiate Liquid peg-ins, peg-outs, swaps, or L-BTC exchange deposits or withdrawals while the network is paused. Follow official Liquid and Blockstream updates, and treat L-BTC peg exposure as impaired until reserves are restored and a verified fix and incident report are published.

Read source ↗
Critical

BTCPay Server: actively exploited LND credential theft

BTCPay confirms that an unauthenticated remote attacker could obtain LND .macaroon credentials, take control of affected LND nodes, and move funds. The vendor reports confirmed exploitation and stolen funds.

Affected: BTCPay Server versions before 2.4.2, including 2.4.2 release candidates, when used with LND. BTCPay says other Lightning implementations are not exposed to this specific credential risk.

Action: Update to BTCPay Server 2.4.2 and LND 0.21.1 immediately, review node activity, and rotate credentials. If you cannot update now, take the affected server offline.

Read source ↗
The watch feed

Changes worth understanding

AI analysis is published as generated. Community notes appear after human validation.

21206 analyses
Highest risk·RSS
Moderate 60 AI analysisMessage 73 · Adequate
EL ElectrumElectrum BitcoinSoftware wallets

Merge pull request #10888 from spesmilo/lnchannel_funding_height_downgrade

This patch fixes a bug in Electrum's Lightning channel handling where a malicious or misbehaving server could trick the wallet into deleting a funded channel by claiming the funding transaction was no longer confirmed. The fix makes the wa…

Fixes downgrade from confirmed to unconfirmed funding heightPrevents removal of funded Lightning channel via malicious/misbehaving serverAdds regression tests for lying-server funding-height downgrade scenario
ff49d634by ThomasV+214−272 files
Vendor flagged security relevance
Open full analysis →Source commit ↗
Informational 12 AI analysisMessage 18 · Opaque
EL ElectrumElectrum BitcoinSoftware wallets

(trivial) simplification

This is a minor code cleanup in Electrum's Lightning Network peer handling. It simplifies how an inner trampoline onion packet is processed, replacing an if-statement with a conditional expression. There is no visible security change: the …

7c8e8ababy ThomasV+6−91 file
No security note in commit
Open full analysis →Source commit ↗
Moderate 58 AI analysisMessage 50 · Thin
BT BTCPay ServerBTCPay Server BitcoinLightning NetworkPayment infrastructure

Require current password for account email changes

This commit adds a security check so that when a user tries to change their email address on their account profile, they must enter their current password. Before this change, an attacker who had already hijacked a logged-in session could …

Account-takeover mitigation: email change now requires password re-authenticationNew model property CurrentPassword with DataType.PasswordController now calls CheckPasswordAsync before applying email change
f681ec7eby Nicolas Dorier+74−137 files
Vendor flagged security relevance
Open full analysis →Source commit ↗
Informational 19 AI analysisMessage 96 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Merge rust-bitcoin/rust-bitcoin#6812: units: Separate mathematical operation and failure mode in `NumOpError`

This is a code-quality refactor in the rust-bitcoin library. It renames and restructures how arithmetic errors (overflow, divide-by-zero, remainder-by-zero) are reported, so callers can tell what specifically went wrong. It does not change…

Refactor of error reporting for checked arithmetic operationsRemoval of public is_overflow()/is_div_by_zero() predicates on NumOpErrorPreservation of original error kind in NumOpResult AddAssign/SubAssign
5897ef1bby Andrew Poelstra+283−1436 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 28 · Opaque
BT BTCPay ServerBTCPay Server BitcoinLightning NetworkPayment infrastructure

Make a signed commit

This commit changes a single word in a build script's status message, from 'if it is possible' to 'whether it is possible'. There is no functional, security, or behavioral change to the software.

e342c62aby Nicolas Dorier+1−11 file
No security note in commit
Open full analysis →Source commit ↗
Low 35 AI analysisMessage 70 · Adequate
BT BTCPay ServerBTCPay Server BitcoinLightning NetworkPayment infrastructure

fix(plugin-manager): use update lookup for installed plugins (#7536)

This commit changes how BTCPay Server's plugin manager asks the plugin directory for update information. Previously, the server fetched the full catalog of plugins and then filtered locally. Now it sends a list of the plugins actually inst…

Reduces information disclosure to external plugin directory by sending only installed/pending plugin list instead of querying full catalogAdds input validation on plugin update response (null entries, missing identifier/version)Improves handling of disabled and pending plugins in update checks
c617a24fby thgO.O+248−685 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 62 · Adequate
KX KruxKrux BitcoinHardware wallets

chore: updates MaixPy glyphs (adds: 49, removes: 4)

This commit only updates a Git submodule pointer for the MaixPy firmware dependency. The actual code changes are stored in the linked submodule repository, not in this commit. There is no visible security-relevant change here.

f963e035by Jean Do+1−11 file
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 65 · Adequate
CK CoinkiteCOLDCARD firmware BitcoinHardware wallets

Drop ValueError message string to save flash space

This commit removes a human-readable error message from a ValueError exception to reduce the amount of flash storage used by the firmware. It is a minor code cleanup and does not change the security behavior of the code. The function still…

dc89513cby copilot-swe-agent[bot]+1−11 file
No security note in commit
Open full analysis →Source commit ↗
Low 49 AI analysisMessage 60 · Adequate
CK CoinkiteCOLDCARD firmware BitcoinHardware wallets

Add changelog entry for msgsign JSON crash fix

This commit only adds a changelog note saying a previous fix stopped the COLDCARD hardware wallet from crashing when a message-signing request was valid JSON but not a JSON object (for example, a number or string instead of a dictionary). …

Device crash on malformed message-signing inputInput vector includes NFC, QR, and SD card JSON filesValid JSON but wrong type (non-object) bypasses simple format checks
07afee0dby copilot-swe-agent[bot]+3−01 file
Vendor flagged security relevance
Open full analysis →Source commit ↗
Informational 23 AI analysisMessage 65 · Adequate
CK CoinkiteCOLDCARD firmware BitcoinHardware wallets

Fix uncaught AttributeError on non-object JSON in parse_msg_sign_request

This commit fixes a bug where the COLDCARD firmware's message-signing feature would crash with an uncaught error if a user supplied valid JSON that wasn't a structured object (for example, a plain number, string, list, or null). The fix ch…

uncaught exception in message parsing pathinput validation gap on JSON typepotential denial-of-service via malformed request
d55ddbceby copilot-swe-agent[bot]+3−01 file
No security note in commit
Open full analysis →Source commit ↗
Informational 18 AI analysisMessage 91 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Merge rust-bitcoin/rust-bitcoin#6346: Make `Keypair::as_inner` private

This change narrows the visibility of an internal helper method (`Keypair::as_inner`) from public to crate-only, and rewrites the Taproot key tweaking code to build a low-level secp256k1 keypair from serialized parts instead of relying on …

Reduced public API surface for sensitive key material (defensive hardening)Introduction of `unsafe` block justified by invariant that reconstructed keypair parts are derived from a valid existing keypairManual secret-key serialization/deserialization and parity handling in cryptographic path
6c617d9cby Andrew Poelstra+12−22 files
No security note in commit
Open full analysis →Source commit ↗
Moderate 59 AI analysisMessage 55 · Thin
XMR Monero ProjectMonero Cryptographic librariesMoneroNode implementationsPrivacy protocols

ringct: fuzz and harden Bulletproof verification

This commit adds a safety cap on the number of proof elements (V) that Monero's Bulletproof and Bulletproof+ verifiers will accept. Before the change, a malformed proof could claim an unusually large number of outputs, potentially causing …

Input-size bound added to cryptographic verifier (V <= maxM)Fuzz target added/updated for Bulletproof verificationUnit test added for 'too many outputs' rejection
c925cc3bby Samy+61−1211 files
No security note in commit
Open full analysis →Source commit ↗
01
Why commit watching?

Security should leave a paper trail.

A quiet fix may be responsible caution—or it may leave users unaware that their assets were ever at risk. CommitWatch preserves the evidence, adds context, and tracks whether vendors disclose, acknowledge, and learn.

Why we built this →