CommitWatch RSS
Continuous public-repository analysis

Open source.
Not open secrets.

We watch what security-critical projects change—then translate the code into clear, independent intelligence anyone can understand.

Explore the watch feed ↓See how scoring works →
34Projects watched
24877Commits captured
21196AI analyses
60High-risk findings · 30d
Active security advisories
Critical

Core Lightning v26.06.9: urgent loss-of-funds security update

Core Lightning says v26.06.9 fixes a newly reported vulnerability that can lead to loss of funds. The release also contains security fixes in channel reestablishment, splicing, HTLC shutdown handling, onion and on-chain handling, gossip range queries, runes, configuration, and several remote-crash and hardening fixes.

Affected: Every Core Lightning node running v26.06.8 or earlier is affected, according to the vendor. Technical tests for the security fixes are temporarily withheld to slow exploit development while operators upgrade.

Action: Upgrade to Core Lightning v26.06.9 immediately. Download the release from https://github.com/ElementsProject/lightning/releases/tag/v26.06.9, verify the appropriate signed SHA256 manifest and checksums for your architecture, install it, restart lightningd, and confirm the running version.

Read source ↗
Critical

Liquid Network: ~4,000 BTC withdrawn in critical peg incident

Liquid confirms that purported white-hat actors withdrew roughly 4,000 BTC (about $320 million) from its federation wallet through the SideSwap PAK. Liquid says the PAK and other federation keys were not compromised. The actors have not yet returned the funds. Independent public analysis points to a newly introduced range-proof cache-key flaw, but Liquid has not yet published its root-cause report.

Affected: The L-BTC peg and Liquid federation reserves are affected. Bridge nodes are disabled, the sidechain is paused, and exchanges have suspended L-BTC deposits and withdrawals. Liquid says other issued assets, including USDT, DePix, and RWAs, are unaffected; Bitcoin's base layer is not affected.

Action: Do not initiate Liquid peg-ins, peg-outs, swaps, or L-BTC exchange deposits or withdrawals while the network is paused. Follow official Liquid and Blockstream updates, and treat L-BTC peg exposure as impaired until reserves are restored and a verified fix and incident report are published.

Read source ↗
Critical

BTCPay Server: actively exploited LND credential theft

BTCPay confirms that an unauthenticated remote attacker could obtain LND .macaroon credentials, take control of affected LND nodes, and move funds. The vendor reports confirmed exploitation and stolen funds.

Affected: BTCPay Server versions before 2.4.2, including 2.4.2 release candidates, when used with LND. BTCPay says other Lightning implementations are not exposed to this specific credential risk.

Action: Update to BTCPay Server 2.4.2 and LND 0.21.1 immediately, review node activity, and rotate credentials. If you cannot update now, take the affected server offline.

Read source ↗
The watch feed

Changes worth understanding

AI analysis is published as generated. Community notes appear after human validation.

21196 analyses
Highest risk·RSS
Low 30 AI analysisMessage 81 · Strong
LDK Lightning Dev Kitrust-lightning BitcoinCryptographic librariesLightning Network

Merge PR 'Skip Electrum creator transaction downloads' (#4992)

This change stops the Electrum-based transaction sync client from downloading the very transaction that created an output it is watching. Previously, the client could request that transaction from Electrum, even though a transaction can ne…

Avoids unnecessary Electrum transaction.get requests for watched outputsReduces information disclosure to Electrum server about watched outpointsAdds regression test verifying request suppression
c36e50cbby Matt Corallo+142−02 files
No security note in commit
Open full analysis →Source commit ↗
Low 44 AI analysisMessage 81 · Strong
LDK Lightning Dev Kitrust-lightning BitcoinCryptographic librariesLightning Network

Merge PR 'Use preferred sPK of watched txn in electrum, not rand ones' (#4867)

This change improves how the Lightning Dev Kit's Electrum and Esplora transaction-sync clients track watched Bitcoin transactions. Previously, the code ignored the script pubkey (the 'address' associated with a transaction) supplied when r…

Previously ignored `script_pubkey` argument in `register_tx` for transaction watchersElectrum script-history queries previously used an arbitrary transaction output, which could be OP_RETURN and therefore unindexed by some Electrum serversNew logic prefers caller-supplied script pubkey and falls back to non-OP_RETURN outputs
bfe5ca89by tnull+52−243 files
No security note in commit
Open full analysis →Source commit ↗
Moderate 61 AI analysisMessage 57 · Thin
TZ TrezorTrezor firmware BitcoinHardware wallets

fix(core): reject malformed protobuf field keys

This commit fixes the way a Trezor hardware wallet's Rust code reads protobuf message field keys. Previously, if reading a field key failed, the decoder silently stopped and treated the message as complete. Now it explicitly checks whether…

silent acceptance of malformed/truncated protobuf inputerror-handling change from swallowing failures to propagating theminput-validation hardening for wire message parsing
e05fcc98by cepetr+9−32 files
No security note in commit
Open full analysis →Source commit ↗
Low 30 AI analysisMessage 62 · Adequate
TZ TrezorTrezor firmware BitcoinHardware wallets

refactor(core): improve internal representation of protobuf definitions

This commit is a code cleanup that changes how Trezor firmware internally labels 32-bit versus 64-bit integer fields in its protobuf handling. It does not add or remove security checks by itself, but it makes the type system more precise s…

Explicit width-aware integer handling in protobuf varint encode/decodeAdded overflow checks for 32-bit and 64-bit varint boundaries in unit testsRefactor of internal type tags; no new user-facing feature
2b4214ccby cepetr+61−235 files
No security note in commit
Open full analysis →Source commit ↗
Critical 89 AI analysisMessage 91 · Strong
AQ ACINQEclair BitcoinLightning Network

More AI fixes and defense-in-depth (#3376)

This is a large security patch for the Eclair Lightning node that fixes multiple ways an attacker could steal funds, burn money to miners, or lock funds forever. The fixes include: preventing force-closes with un-publishable splice transac…

Force-close uses latest publishable commitment to avoid unconfirmable splice commit txsClosing fee bounded by maxClosingFeerate when local node pays feesNew max-funding-feerate configuration caps funding/splice miner fees
4111ad86by pm47+698−9835 files
Vendor flagged security relevance
Open full analysis →Source commit ↗
Low 38 AI analysisMessage 78 · Adequate
AQ ACINQEclair BitcoinLightning Network

Tor: allow password auth on private networks (#3375)

This change expands when Eclair will allow password-based authentication to a Tor control port. Previously, only loopback addresses (the same machine) were considered safe enough for password auth. Now, private/site-local and link-local ne…

Relaxation of authentication-method restriction for Tor control portPassword authentication now permitted on site-local and link-local addressesOriginal code explicitly rejected password auth for non-loopback addresses
8b58405dby pm47+1−11 file
No security note in commit
Open full analysis →Source commit ↗
Moderate 60 AI analysisMessage 97 · Strong
TZ TrezorTrezor firmware BitcoinHardware wallets

refactor(core/sys): make writing bootargs a privilege, not a convention

This commit removes a low-level interface that let any software component tell the device what to do on its next reboot. The change makes reboot control a privileged operation only, so unprivileged code can no longer pick arbitrary boot co…

Removal of unprivileged secure-monitor call SMCALL_BOOTARGS_SETbootargs_set() now gated behind SECURE_MODE build flagsystem_emergency_rescue() now compiled only where bootargs can be written
69d3435cby tychovrahe+7−307 files
Vendor flagged security relevance
Open full analysis →Source commit ↗
Moderate 60 AI analysisMessage 100 · Strong
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

Merge bitcoin/bitcoin#35975: wallet: Fix `CWalletTx` malleated transaction metadata sync

This update fixes a bug in Bitcoin Core's wallet that could crash the program when a user tried to speed up (bump) a transaction that had a slightly altered copy (a 'malleated' version) in the wallet. It also ensures that notes, replacemen…

Assertion failure / crash reachable through normal wallet RPC usage (bumpfee)Incorrect metadata propagation between malleated wallet transactionsRace/order-of-operations issue between metadata sync and MarkReplaced
d25470d9by merge-script+202−6513 files
Vendor flagged security relevance
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 93 · Strong
TZ TrezorTrezor firmware BitcoinHardware wallets

docs(crypto): reproduce third-party license texts in crypto/LICENSE (#7529)

This commit is purely legal and administrative housekeeping. It adds missing third-party copyright notices and license texts to the crypto/LICENSE file, fixes a typo in a few license headers, and changes the stated license of some first-pa…

eaffadbaby petrsusil+514−438 files
No security note in commit
Open full analysis →Source commit ↗
High 71 AI analysisMessage 83 · Strong
FD FoundationPassport firmware BitcoinHardware wallets

Merge pull request #675 from Foundation-Devices/fix/verify-change-before-review

This firmware update moves the verification of Bitcoin 'change' addresses to happen before the user reviews the transaction on screen. Previously, the device checked whether change outputs truly belonged to the wallet only after the user h…

Reorders security-critical validation to occur before user approvalValidates change-output ownership before the review screen hides those outputsPrevents transaction signing if change derivation does not match the PSBT
1fea63c8by Jacksper13+174−454 files
Vendor flagged security relevance
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 91 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Merge rust-bitcoin/rust-bitcoin#6867: consensus_encoding: Flatten remaining error constructors

This commit is a pure code-style refactor. It rewrites how error values are constructed in the consensus encoding/decoding code, replacing direct nested constructor calls with chained `map_err` calls. The pull request explicitly states the…

4998e1c5by Andrew Poelstra+18−193 files
No security note in commit
Open full analysis →Source commit ↗
Informational 14 AI analysisMessage 73 · Adequate
EP Elements ProjectCore Lightning BitcoinLightning Network

ccan: update for newer compiler fixes.

This commit updates two internal helper files in the CCAN library to silence compiler warnings when building with newer GCC versions. One change swaps an anonymous struct for an anonymous union inside a compile-time size check, because GCC…

No security-relevant signal in commit message or diffChanges are compiler warning fixes, not vulnerability fixesNo mention of CVE, security bug, researcher credit, or exploit
e3dc8e9fby Rusty Russell+7−43 files
No security note in commit
Open full analysis →Source commit ↗
01
Why commit watching?

Security should leave a paper trail.

A quiet fix may be responsible caution—or it may leave users unaware that their assets were ever at risk. CommitWatch preserves the evidence, adds context, and tracks whether vendors disclose, acknowledge, and learn.

Why we built this →