CommitWatch RSS
Continuous public-repository analysis

Open source.
Not open secrets.

We watch what security-critical projects change—then translate the code into clear, independent intelligence anyone can understand.

Explore the watch feed ↓See how scoring works →
34Projects watched
24635Commits captured
21071AI analyses
58High-risk findings · 30d
Active security advisories
Critical

Core Lightning v26.06.9: urgent loss-of-funds security update

Core Lightning says v26.06.9 fixes a newly reported vulnerability that can lead to loss of funds. The release also contains security fixes in channel reestablishment, splicing, HTLC shutdown handling, onion and on-chain handling, gossip range queries, runes, configuration, and several remote-crash and hardening fixes.

Affected: Every Core Lightning node running v26.06.8 or earlier is affected, according to the vendor. Technical tests for the security fixes are temporarily withheld to slow exploit development while operators upgrade.

Action: Upgrade to Core Lightning v26.06.9 immediately. Download the release from https://github.com/ElementsProject/lightning/releases/tag/v26.06.9, verify the appropriate signed SHA256 manifest and checksums for your architecture, install it, restart lightningd, and confirm the running version.

Read source ↗
Critical

Liquid Network: ~4,000 BTC withdrawn in critical peg incident

Liquid confirms that purported white-hat actors withdrew roughly 4,000 BTC (about $320 million) from its federation wallet through the SideSwap PAK. Liquid says the PAK and other federation keys were not compromised. The actors have not yet returned the funds. Independent public analysis points to a newly introduced range-proof cache-key flaw, but Liquid has not yet published its root-cause report.

Affected: The L-BTC peg and Liquid federation reserves are affected. Bridge nodes are disabled, the sidechain is paused, and exchanges have suspended L-BTC deposits and withdrawals. Liquid says other issued assets, including USDT, DePix, and RWAs, are unaffected; Bitcoin's base layer is not affected.

Action: Do not initiate Liquid peg-ins, peg-outs, swaps, or L-BTC exchange deposits or withdrawals while the network is paused. Follow official Liquid and Blockstream updates, and treat L-BTC peg exposure as impaired until reserves are restored and a verified fix and incident report are published.

Read source ↗
Critical

BTCPay Server: actively exploited LND credential theft

BTCPay confirms that an unauthenticated remote attacker could obtain LND .macaroon credentials, take control of affected LND nodes, and move funds. The vendor reports confirmed exploitation and stolen funds.

Affected: BTCPay Server versions before 2.4.2, including 2.4.2 release candidates, when used with LND. BTCPay says other Lightning implementations are not exposed to this specific credential risk.

Action: Update to BTCPay Server 2.4.2 and LND 0.21.1 immediately, review node activity, and rotate credentials. If you cannot update now, take the affected server offline.

Read source ↗
The watch feed

Changes worth understanding

AI analysis is published as generated. Community notes appear after human validation.

21071 analyses
Highest risk·RSS
Informational 15 AI analysisMessage 93 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

build(deps): bump astral-sh/setup-uv from 8.3.2 to 9.0.0

This is a routine automated update by Dependabot that changes the pinned version of a GitHub Action used to install a Python tool called 'uv' in two workflow files. The new version is a major release of the setup-uv action itself, but the …

7d7e7269by dependabot[bot]+2−22 files
No security note in commit
Open full analysis →Source commit ↗
Low 27 AI analysisMessage 65 · Adequate
XMR Monero ProjectMonero Cryptographic librariesMoneroNode implementationsPrivacy protocols

wallet: persist set_daemon params across wallet loads. - allow set_daemon without a wallet loaded

This Monero commit changes how the wallet remembers which daemon (server) it should connect to. Previously, if you told the wallet RPC server to use a specific daemon before any wallet was open, that setting was lost as soon as you opened …

Daemon connection parameters now persist across wallet creation/opening via m_pending_daemonset_daemon can now be invoked before any wallet is loaded, storing config server-sideTrusted-daemon flag is now part of persisted daemon config and can change implicitly across wallet reloads
de19ff65by nahuhh+101−316 files
No security note in commit
Open full analysis →Source commit ↗
Low 35 AI analysisMessage 45 · Thin
XMR Monero ProjectMonero Cryptographic librariesMoneroNode implementationsPrivacy protocols

wallet: let set_daemon override --proxy

This Monero wallet commit changes how proxy settings are handled. Previously, if you started the wallet with a global --proxy option, you could not later use the set_daemon command to pick a different proxy for a specific daemon. The commi…

Relaxation of proxy-conflict guardDaemon-specific proxy can override global --proxyPotential for unexpected proxy change via RPC set_daemon
a7aed9b9by nahuhh+3−243 files
No security note in commit
Open full analysis →Source commit ↗
Moderate 57 AI analysisMessage 60 · Adequate
XMR Monero ProjectMonero Cryptographic librariesMoneroNode implementationsPrivacy protocols

wallet2: validate legacy transfer output indices

This commit adds a safety check when loading older Monero wallet data. It ensures that a stored 'output index' (which points to a specific coin within a past transaction) does not point past the number of outputs that transaction actually …

Out-of-bounds index validation added during deserializationLegacy data format specifically targeted (ver < 4)Throws archive exception to abort loading invalid state
4c824408by selsta+3−01 file
No security note in commit
Open full analysis →Source commit ↗
Moderate 57 AI analysisMessage 60 · Adequate
XMR Monero ProjectMonero Cryptographic librariesMoneroNode implementationsPrivacy protocols

wallet2: check reserve proof additional key index

This patch tightens a safety check in Monero's wallet when creating a 'reserve proof' (a cryptographic receipt proving funds exist). Previously the wallet only checked whether any extra public keys existed at all; now it checks whether the…

Bounds-check hardening on array index before useOut-of-bounds read risk in reserve-proof generationPotential use of invalid tx pub key pointer
923ee545by selsta+2−21 file
No security note in commit
Open full analysis →Source commit ↗
Moderate 59 AI analysisMessage 65 · Adequate
XMR Monero ProjectMonero Cryptographic librariesMoneroNode implementationsPrivacy protocols

wallet2: validate key data in password and device checks

This update adds safety checks to Monero's wallet code when reading wallet key files. Previously, the code assumed the file contained a properly formatted JSON object with a 'key_data' text field. If a file was malformed or missing that fi…

Missing input validation on parsed JSON before pointer/string accessPotential null-pointer or out-of-bounds read in wallet key file handlingCrash or undefined behavior possible with malformed wallet keys file
cbf33310by selsta+10−01 file
No security note in commit
Open full analysis →Source commit ↗
Low 36 AI analysisMessage 60 · Adequate
XMR Monero ProjectMonero Cryptographic librariesMoneroNode implementationsPrivacy protocols

wallet2: normalize account tags before assignment

This small change makes the wallet refresh its account-tag list before assigning a tag to accounts. Without this refresh, the wallet might act on stale or inconsistent tag data, which could lead to tags being applied to the wrong accounts …

State consistency fix in wallet tag assignmentReported by external party (xmrack / MAGIC Monero Fund)Single-line defensive patch suggesting a narrow bug rather than broad redesign
b76c4b7aby selsta+1−01 file
No security note in commit
Open full analysis →Source commit ↗
Low 29 AI analysisMessage 73 · Adequate
XMR Monero ProjectMonero Cryptographic librariesMoneroNode implementationsPrivacy protocols

Polyseed support for 'wallet2', Wallet API, CLI wallet app, wallet RPC server

This commit adds support for a new type of wallet backup phrase called Polyseed to the Monero wallet software. It touches many wallet components (CLI, RPC, library API) so users can create, restore, and display Polyseed backups alongside t…

Changes secret-key serialization format (m_polyseed and m_monero_c_passphrase added to account_keys KV map)Modifies key-stream XOR encryption to include new fields, with explicit backward-compatibility ordering commentAdds new seed-derivation path using external polyseed library and PBKDF2-HMAC-SHA256
c8699f24by rbrunner7+1653−28031 files
No security note in commit
Open full analysis →Source commit ↗
Informational 20 AI analysisMessage 68 · Adequate
SS SeedSignerSeedSigner BitcoinHardware wallets

Settle is_high_fee once in parse()

This commit is a performance cleanup, not a security fix. It calculates the 'is this fee unusually high?' flag once during transaction parsing instead of recalculating it every time a screen asks. The actual fee-checking logic and warning …

No security-relevant logic change: the same fee threshold and calculation are usedPerformance optimization only: eliminates repeated transaction re-summationNo input validation, cryptography, or authorization changes
2195adfdby okaybro+32−53 files
No security note in commit
Open full analysis →Source commit ↗
Informational 21 AI analysisMessage 100 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Merge rust-bitcoin/rust-bitcoin#6894: Harden `Copy` policy and apply to all pre-1.0 crates

This commit removes the automatic `Copy` trait from several public error types in the rust-bitcoin library and updates the project's written policy to discourage `Copy` on error types. `Copy` is a Rust trait that lets values be duplicated …

API hardening: removes `Copy` from public error types to preserve future flexibilityPolicy update: docs/policy.md now explicitly discourages `Copy` on error typesNo vulnerability fix: change is defensive/preventive, not reactive to a disclosed issue
457cb9b5by Andrew Poelstra+14−146 files
No security note in commit
Open full analysis →Source commit ↗
Moderate 68 AI analysisMessage 73 · Adequate
EL ElectrumElectrum BitcoinSoftware wallets

Merge pull request #10981 from spesmilo/do_not_sign_txin_with_witness

This change prevents Electrum from re-signing Bitcoin transaction inputs that already contain a witness (the data proving the input was authorized). The patch fixes a bug where Electrum could incorrectly sign a non-SegWit input as if it we…

Incorrect signature algorithm selection for non-SegWit inputs when witness data is presentPSBT handling edge case where pre-existing witness data influences signing pathPotential invalid signature production during transaction signing
9da4c342by ThomasV+10−21 file
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 28 · Opaque
CW Cake WalletCake Wallet / Monero.com MoneroPrivacy protocolsSoftware wallets

minor fix [skip ci]

This commit is a routine code cleanup in a single Flutter UI file. It replaces verbose 'return { ... }' function bodies with arrow syntax, adds 'const' keywords where Flutter can optimize widget rebuilds, and tweaks one loading-state updat…

88498e84by Omar+29−441 file
No security note in commit
Open full analysis →Source commit ↗
01
Why commit watching?

Security should leave a paper trail.

A quiet fix may be responsible caution—or it may leave users unaware that their assets were ever at risk. CommitWatch preserves the evidence, adds context, and tracks whether vendors disclose, acknowledge, and learn.

Why we built this →