CommitWatch RSS
Continuous public-repository analysis

Open source.
Not open secrets.

We watch what security-critical projects change—then translate the code into clear, independent intelligence anyone can understand.

Explore the watch feed ↓See how scoring works →
34Projects watched
24873Commits captured
21194AI analyses
60High-risk findings · 30d
Active security advisories
Critical

Core Lightning v26.06.9: urgent loss-of-funds security update

Core Lightning says v26.06.9 fixes a newly reported vulnerability that can lead to loss of funds. The release also contains security fixes in channel reestablishment, splicing, HTLC shutdown handling, onion and on-chain handling, gossip range queries, runes, configuration, and several remote-crash and hardening fixes.

Affected: Every Core Lightning node running v26.06.8 or earlier is affected, according to the vendor. Technical tests for the security fixes are temporarily withheld to slow exploit development while operators upgrade.

Action: Upgrade to Core Lightning v26.06.9 immediately. Download the release from https://github.com/ElementsProject/lightning/releases/tag/v26.06.9, verify the appropriate signed SHA256 manifest and checksums for your architecture, install it, restart lightningd, and confirm the running version.

Read source ↗
Critical

Liquid Network: ~4,000 BTC withdrawn in critical peg incident

Liquid confirms that purported white-hat actors withdrew roughly 4,000 BTC (about $320 million) from its federation wallet through the SideSwap PAK. Liquid says the PAK and other federation keys were not compromised. The actors have not yet returned the funds. Independent public analysis points to a newly introduced range-proof cache-key flaw, but Liquid has not yet published its root-cause report.

Affected: The L-BTC peg and Liquid federation reserves are affected. Bridge nodes are disabled, the sidechain is paused, and exchanges have suspended L-BTC deposits and withdrawals. Liquid says other issued assets, including USDT, DePix, and RWAs, are unaffected; Bitcoin's base layer is not affected.

Action: Do not initiate Liquid peg-ins, peg-outs, swaps, or L-BTC exchange deposits or withdrawals while the network is paused. Follow official Liquid and Blockstream updates, and treat L-BTC peg exposure as impaired until reserves are restored and a verified fix and incident report are published.

Read source ↗
Critical

BTCPay Server: actively exploited LND credential theft

BTCPay confirms that an unauthenticated remote attacker could obtain LND .macaroon credentials, take control of affected LND nodes, and move funds. The vendor reports confirmed exploitation and stolen funds.

Affected: BTCPay Server versions before 2.4.2, including 2.4.2 release candidates, when used with LND. BTCPay says other Lightning implementations are not exposed to this specific credential risk.

Action: Update to BTCPay Server 2.4.2 and LND 0.21.1 immediately, review node activity, and rotate credentials. If you cannot update now, take the affected server offline.

Read source ↗
The watch feed

Changes worth understanding

AI analysis is published as generated. Community notes appear after human validation.

21194 analyses
Highest risk·RSS
Low 47 AI analysisMessage 76 · Adequate
KS KeystoneKeystone 3 firmware BitcoinHardware wallets

Merge release v3.0.6 (#2290)

This firmware update adds support for Solana's new V1 transaction format and changes how oversized or malformed transaction details are displayed. The code introduces a dedicated parser for V1 messages with strict size and structure checks…

New parser enforces hard limits on V1 message fields and rejects malformed 0x81-prefix payloads instead of falling back to message signingCompute-budget instructions in V1 are explicitly ignored to prevent fee-display spoofingUI pagination change for large transaction details reduces truncation risk
87b78ae1by github-actions[bot]+564−2812 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 91 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Merge rust-bitcoin/rust-bitcoin#6870: crypto: Flatten nested error constructors

This commit is a code cleanup that rewrites how errors are wrapped in the Bitcoin crypto library. It changes nested error constructors into chained map_err calls but keeps the exact same error values and public behavior. There is no securi…

be98a391by Andrew Poelstra+15−153 files
No security note in commit
Open full analysis →Source commit ↗
Moderate 68 AI analysisMessage 73 · Adequate
EP Elements ProjectCore Lightning BitcoinLightning Network

closingd: fail the negotiation when lightningd rejects the peer's closing fee

This fix repairs a bug in Core Lightning's channel-closing handshake. Previously, when the node rejected a peer's proposed closing fee, the rejection was not communicated back to the sub-process that negotiates with the peer. That sub-proc…

State inconsistency between closingd and lightningd during mutual closeRejected closing fee could still lead to broadcasting the commitment transactionUser-visible close status ('mutual close') did not match on-chain behavior
a764f9c1by Ken Sedgwick+33−114 files
Vendor flagged security relevance
Open full analysis →Source commit ↗
Low 37 AI analysisMessage 45 · Thin
EL ElectrumElectrum BitcoinSoftware wallets

qt: explicitly opt-in to RichText where used

This commit makes the Electrum desktop wallet explicitly tell its Qt GUI widgets to interpret certain text as rich HTML-like text, rather than leaving it on the automatic/default setting. In recent Qt versions, the default behavior changed…

Explicit RichText opt-in across many Qt labels after Qt behavior changeOne HTML-rich label converted to plain-text formatting (Revealer calibration dialog)No input validation or escaping changes observed
c83992f7by SomberNight+29−613 files
No security note in commit
Open full analysis →Source commit ↗
Informational 11 AI analysisMessage 45 · Thin
EL ElectrumElectrum BitcoinSoftware wallets

qml: explicitly opt-in to RichText where used

This commit adds explicit 'RichText' formatting markers to several user-interface text labels in Electrum's QML (mobile-style) GUI. Previously these labels may have implicitly rendered HTML-like tags. The change is a cleanup/adaptation to …

RichText / HTML rendering in UI componentsLabels display wallet metadata (name, amount, exception report text)No input sanitization or escaping changes present in diff
841529b4by SomberNight+6−06 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 45 · Thin
SW Stack WalletStack Wallet MoneroPrivacy protocolsSoftware wallets

frostdart submodule -> native assets migration

This commit changes how the app pulls in a supporting cryptography library called frostdart. Previously it was included as a local submodule; now it is fetched directly from its GitHub repository at a specific commit. There is nothing in t…

2e20340fby Julian+9−94 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 96 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Merge rust-bitcoin/rust-bitcoin#6882: build(deps): bump taiki-e/install-action from 2.82.11 to 2.83.2

This is a routine update to a GitHub Actions helper used in automated testing workflows. It changes the pinned version of taiki-e/install-action (a tool installer) from 2.82.11 to 2.83.2 in two workflow files. There is no indication this f…

a18caa85by Andrew Poelstra+2−22 files
No security note in commit
Open full analysis →Source commit ↗
Low 35 AI analysisMessage 75 · Adequate
CW Cake WalletCake Wallet / Monero.com MoneroPrivacy protocolsSoftware wallets

fix: sign and verify for evm wallets (#3599)

This commit fixes how Cake Wallet's EVM (Ethereum-compatible) wallets sign and verify messages. It switches message encoding from ASCII to UTF-8, removes a third-party signature utility, and adds stricter checks on the address and signatur…

Encoding change from ASCII to UTF-8 for signed messagesManual signature verification replacing third-party library callAdded input validation for address and signature length
96e5329bby David Adegoke+31−101 file
No security note in commit
Open full analysis →Source commit ↗
Low 37 AI analysisMessage 45 · Thin
XMR Monero ProjectMonero Cryptographic librariesMoneroNode implementationsPrivacy protocols

wallet_api: clear stale daemon login

This small patch fixes a state-cleanup bug in Monero's wallet API. Previously, when a wallet connected to a new daemon without providing a username, it could accidentally reuse login credentials from an earlier connection. The patch now ex…

stale credential reuseauthentication state not reset across re-initializationmissing else branch in conditional credential assignment
b2b8c816by selsta+2−01 file
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 91 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Merge rust-bitcoin/rust-bitcoin#6878: Automated nightly rustfmt (2026-09-13)

This commit is an automated code-formatting run by a bot. It only changes whitespace, line breaks, and brace placement in four source files. No program logic, math, or security behavior was altered.

c1af7e19by Andrew Poelstra+16−124 files
No security note in commit
Open full analysis →Source commit ↗
Informational 3 AI analysisMessage 45 · Thin
MG MAGIC GrantsSkylight Wallet MoneroPrivacy protocolsSoftware wallets

Bump build number and update wallet core pin

This commit only updates the app's version number and switches its internal wallet-core library to a newer pinned commit. No actual code changes are shown, and the commit message does not say anything about fixing a security problem. On it…

451a08ebby Keeqler+22−222 files
No security note in commit
Open full analysis →Source commit ↗
Low 37 AI analysisMessage 70 · Adequate
XMR Monero ProjectMonero Cryptographic librariesMoneroNode implementationsPrivacy protocols

http: bind Digest authentication to the request URI

This commit fixes a security gap in how HTTP Digest authentication was validated in Monero's built-in HTTP server. Previously, a valid authentication response for one URL could potentially be accepted for a different URL. The fix now check…

Digest authentication URI binding enforcedRequest target mismatch now rejectedNew negative test cases for URI mismatch
6c79985aby selsta+56−102 files
Vendor flagged security relevance
Open full analysis →Source commit ↗
01
Why commit watching?

Security should leave a paper trail.

A quiet fix may be responsible caution—or it may leave users unaware that their assets were ever at risk. CommitWatch preserves the evidence, adds context, and tracks whether vendors disclose, acknowledge, and learn.

Why we built this →