CommitWatch RSS
Continuous public-repository analysis

Open source.
Not open secrets.

We watch what security-critical projects change—then translate the code into clear, independent intelligence anyone can understand.

Explore the watch feed ↓See how scoring works →
34Projects watched
24907Commits captured
21206AI analyses
53High-risk findings · 30d
Active security advisories
Critical

Core Lightning v26.06.9: urgent loss-of-funds security update

Core Lightning says v26.06.9 fixes a newly reported vulnerability that can lead to loss of funds. The release also contains security fixes in channel reestablishment, splicing, HTLC shutdown handling, onion and on-chain handling, gossip range queries, runes, configuration, and several remote-crash and hardening fixes.

Affected: Every Core Lightning node running v26.06.8 or earlier is affected, according to the vendor. Technical tests for the security fixes are temporarily withheld to slow exploit development while operators upgrade.

Action: Upgrade to Core Lightning v26.06.9 immediately. Download the release from https://github.com/ElementsProject/lightning/releases/tag/v26.06.9, verify the appropriate signed SHA256 manifest and checksums for your architecture, install it, restart lightningd, and confirm the running version.

Read source ↗
Critical

Liquid Network: ~4,000 BTC withdrawn in critical peg incident

Liquid confirms that purported white-hat actors withdrew roughly 4,000 BTC (about $320 million) from its federation wallet through the SideSwap PAK. Liquid says the PAK and other federation keys were not compromised. The actors have not yet returned the funds. Independent public analysis points to a newly introduced range-proof cache-key flaw, but Liquid has not yet published its root-cause report.

Affected: The L-BTC peg and Liquid federation reserves are affected. Bridge nodes are disabled, the sidechain is paused, and exchanges have suspended L-BTC deposits and withdrawals. Liquid says other issued assets, including USDT, DePix, and RWAs, are unaffected; Bitcoin's base layer is not affected.

Action: Do not initiate Liquid peg-ins, peg-outs, swaps, or L-BTC exchange deposits or withdrawals while the network is paused. Follow official Liquid and Blockstream updates, and treat L-BTC peg exposure as impaired until reserves are restored and a verified fix and incident report are published.

Read source ↗
Critical

BTCPay Server: actively exploited LND credential theft

BTCPay confirms that an unauthenticated remote attacker could obtain LND .macaroon credentials, take control of affected LND nodes, and move funds. The vendor reports confirmed exploitation and stolen funds.

Affected: BTCPay Server versions before 2.4.2, including 2.4.2 release candidates, when used with LND. BTCPay says other Lightning implementations are not exposed to this specific credential risk.

Action: Update to BTCPay Server 2.4.2 and LND 0.21.1 immediately, review node activity, and rotate credentials. If you cannot update now, take the affected server offline.

Read source ↗
The watch feed

Changes worth understanding

AI analysis is published as generated. Community notes appear after human validation.

21206 analyses
Highest risk·RSS
High 70 AI analysisMessage 78 · Adequate
XMR Monero ProjectMonero Cryptographic librariesMoneroNode implementationsPrivacy protocols

wallet2: fix infinite loop in estimate_tx_size_and_weight on large n_outputs

This patch fixes a bug where a single wallet command could freeze the wallet-rpc handling thread forever. The bug occurs when a user asks the wallet to estimate the size of a transaction with an extremely large number of outputs (more than…

Infinite loop / denial of service in wallet-rpc handling threadSigned integer overflow in bit-shift loopUnbounded n_outputs accepted by estimate_tx_size_and_weight
a3deaab9by Masamune+13−131 file
Vendor flagged security relevance
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 87 · Strong
TZ TrezorTrezor firmware BitcoinHardware wallets

test: check `Features.max_passphrase_len` in device tests

This commit only adds a test assertion to verify that the maximum passphrase length reported by a Trezor device matches the expected value for its model family (50 characters for legacy devices, 128 for newer 'core' devices). It is a pure …

0bd16debby Roman Zeyde+2−11 file
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 93 · Strong
EP Elements Projectlibwally-core BitcoinCryptographic librariesSoftware wallets

build(deps-dev): bump browserslist in /src/wasm_package

This is a routine automated update by Dependabot that bumps the version of a JavaScript build tool called browserslist, used only in the WebAssembly packaging part of the project. The change only updates version numbers and metadata in a l…

834987a8by dependabot[bot]+65−511 file
No security note in commit
Open full analysis →Source commit ↗
Informational 14 AI analysisMessage 93 · Strong
EP Elements Projectlibwally-core BitcoinCryptographic librariesSoftware wallets

build(deps-dev): bump fast-uri from 3.1.5 to 3.1.7 in /src/wasm_package

This is a routine automated update by Dependabot that bumps the JavaScript helper library fast-uri from version 3.1.5 to 3.1.7 inside the WebAssembly packaging directory. The commit itself only changes a package-lock.json file and does not…

Dependency update for a known URI-parsing libraryfast-uri 3.1.7 is associated with a fix for a malformed-URI parsing issue (CVE-2025-24035)Only package-lock.json changed; no application code modified
05843a61by dependabot[bot]+8−71 file
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 100 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Merge rust-bitcoin/rust-bitcoin#6814: fuzz: delete stale `hashes_0_32_cbor` target

This commit removes an old fuzzing test that was producing false alarms. The test checked that data could be decoded and re-encoded by an old library (serde_cbor) and get the exact same bytes back, but that library has multiple valid ways …

No security signal: removal of stale fuzz target causing false-positive corpus crashesNo runtime code changesNo bug fix or vulnerability patch present in diff
4f61264dby Andrew Poelstra+0−774 files
No security note in commit
Open full analysis →Source commit ↗
Informational 19 AI analysisMessage 58 · Thin
LL Lightning LabsLND BitcoinLightning Network

Merge pull request #10812 from ziggie1984/chanstate-kv-store-move

This commit is a large internal code reorganization for the LND Lightning node. It moves channel state storage logic from the `channeldb` package into a new `chanstate` package, while keeping the same database keys, serialization formats, …

Large refactoring with no change to cryptographic or consensus-critical logicCodec serialization moved verbatim to new package; wire format unchangedDatabase bucket keys and TLV record types preserved
62b0a073by Olaoluwa Osuntokun+3923−310924 files
No security note in commit
Open full analysis →Source commit ↗
Informational 19 AI analysisMessage 50 · Thin
XMR Monero ProjectMonero GUI MoneroPrivacy protocolsSoftware wallets

TransactionHistoryModel: only place pending tx first

This commit fixes a display bug in the Monero GUI wallet's transaction history list. Previously, failed transactions were being shown at the top of the list alongside pending transactions, because any transaction without a confirmed block …

UI presentation bug, not a memory-safety or cryptographic issueNo attacker-controlled input parsing changedNo privilege escalation, authentication, or authorization logic modified
27328f36by selsta+6−51 file
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 50 · Thin
XMR Monero ProjectMonero GUI MoneroPrivacy protocolsSoftware wallets

History: improve display of transactions with multiple recipients

This commit is a user-interface improvement for the Monero GUI wallet's transaction history screen. It changes how outgoing payments to multiple recipients are displayed, searched, and copied. There is no security vulnerability here; it is…

a3dc3882by selsta+84−185 files
No security note in commit
Open full analysis →Source commit ↗
Low 42 AI analysisMessage 50 · Thin
XMR Monero ProjectMonero GUI MoneroPrivacy protocolsSoftware wallets

Wallet: fix send confirmation stale transaction race

This patch fixes a race condition in the Monero GUI wallet's send screen. If a user quickly changed send details or canceled a transaction while an earlier transaction was still being prepared in the background, the wallet could mix up the…

Race condition between asynchronous transaction creation and UI state changesPotential use of stale PendingTransaction object after cancellation/replacementMemory leak via undisposed PendingTransaction objects on rejection paths
3f2d9794by selsta+57−243 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 91 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Merge rust-bitcoin/rust-bitcoin#6767: primitives: Add #[inline] to simple functions

This commit only adds the Rust compiler hint #[inline] to many small, simple functions in the primitives crate. It does not change any logic, data handling, or security behavior. It is a performance and code-quality change, not a security …

ff93b704by Andrew Poelstra+168−017 files
No security note in commit
Open full analysis →Source commit ↗
Low 42 AI analysisMessage 86 · Strong
LDK Lightning Dev Kitrust-lightning BitcoinCryptographic librariesLightning Network

Merge PR 'Drop stale splice signature on disconnect' (#4954)

This change fixes a Lightning channel splicing bug: when two peers temporarily disconnect during a splice, any half-finished signature the other side already sent is now discarded. Before the fix, that stale signature could be reused after…

State-invalidation bug in multi-step protocol (splice negotiation)Stale cryptographic signature not cleared on disconnectPotential reuse of old commitment state after reconnect
c9a77251by Matt Corallo+22−12 files
No security note in commit
Open full analysis →Source commit ↗
Low 25 AI analysisMessage 73 · Adequate
LL Lightning LabsLND BitcoinLightning Network

Merge pull request #10804 from GeorgeTsagk/close-immediately-itest-lnd-7c38

This change fixes a data-handling bug in LND's channel-opening code. When opening a Lightning channel using an optional 'auxiliary funding controller' (used for custom channel types such as Taproot Assets), the funding manager was previous…

Data-correctness fix in funding handshake: negotiated channel configs now exposed to auxiliary funding controllerAuxiliary funding controller receives incomplete channel state before patch, complete state after patchNo explicit security claim, CVE, or advisory referenced in commit or supplied materials
1e127653by Olaoluwa Osuntokun+291−254 files
No security note in commit
Open full analysis →Source commit ↗
01
Why commit watching?

Security should leave a paper trail.

A quiet fix may be responsible caution—or it may leave users unaware that their assets were ever at risk. CommitWatch preserves the evidence, adds context, and tracks whether vendors disclose, acknowledge, and learn.

Why we built this →