CommitWatch RSS
Continuous public-repository analysis

Open source.
Not open secrets.

We watch what security-critical projects change—then translate the code into clear, independent intelligence anyone can understand.

Explore the watch feed ↓See how scoring works →
34Projects watched
24898Commits captured
21206AI analyses
53High-risk findings · 30d
Active security advisories
Critical

Core Lightning v26.06.9: urgent loss-of-funds security update

Core Lightning says v26.06.9 fixes a newly reported vulnerability that can lead to loss of funds. The release also contains security fixes in channel reestablishment, splicing, HTLC shutdown handling, onion and on-chain handling, gossip range queries, runes, configuration, and several remote-crash and hardening fixes.

Affected: Every Core Lightning node running v26.06.8 or earlier is affected, according to the vendor. Technical tests for the security fixes are temporarily withheld to slow exploit development while operators upgrade.

Action: Upgrade to Core Lightning v26.06.9 immediately. Download the release from https://github.com/ElementsProject/lightning/releases/tag/v26.06.9, verify the appropriate signed SHA256 manifest and checksums for your architecture, install it, restart lightningd, and confirm the running version.

Read source ↗
Critical

Liquid Network: ~4,000 BTC withdrawn in critical peg incident

Liquid confirms that purported white-hat actors withdrew roughly 4,000 BTC (about $320 million) from its federation wallet through the SideSwap PAK. Liquid says the PAK and other federation keys were not compromised. The actors have not yet returned the funds. Independent public analysis points to a newly introduced range-proof cache-key flaw, but Liquid has not yet published its root-cause report.

Affected: The L-BTC peg and Liquid federation reserves are affected. Bridge nodes are disabled, the sidechain is paused, and exchanges have suspended L-BTC deposits and withdrawals. Liquid says other issued assets, including USDT, DePix, and RWAs, are unaffected; Bitcoin's base layer is not affected.

Action: Do not initiate Liquid peg-ins, peg-outs, swaps, or L-BTC exchange deposits or withdrawals while the network is paused. Follow official Liquid and Blockstream updates, and treat L-BTC peg exposure as impaired until reserves are restored and a verified fix and incident report are published.

Read source ↗
Critical

BTCPay Server: actively exploited LND credential theft

BTCPay confirms that an unauthenticated remote attacker could obtain LND .macaroon credentials, take control of affected LND nodes, and move funds. The vendor reports confirmed exploitation and stolen funds.

Affected: BTCPay Server versions before 2.4.2, including 2.4.2 release candidates, when used with LND. BTCPay says other Lightning implementations are not exposed to this specific credential risk.

Action: Update to BTCPay Server 2.4.2 and LND 0.21.1 immediately, review node activity, and rotate credentials. If you cannot update now, take the affected server offline.

Read source ↗
The watch feed

Changes worth understanding

AI analysis is published as generated. Community notes appear after human validation.

21206 analyses
Highest risk·RSS
Informational 12 AI analysisMessage 95 · Strong
BT btcsuitebtcd BitcoinNode implementations

psbt: test multi_a excess signature handling

This commit only adds a new unit test for the PSBT finalizer. It checks that when a Bitcoin Taproot multi-signature (multi_a) input has more valid signatures than required, the finalizer picks exactly the required number and leaves the ext…

26ee1cc8by Olaoluwa Osuntokun+33−01 file
No security note in commit
Open full analysis →Source commit ↗
Informational 12 AI analysisMessage 95 · Strong
BT btcsuitebtcd BitcoinNode implementations

psbt: test multi_a signature input ordering

This commit only adds a new test case to the project's test suite. It does not change any production code. The test verifies that a PSBT (Partially Signed Bitcoin Transaction) finalizer correctly orders signatures for a specific type of Ta…

Regression test for Taproot multi_a signature orderingNo production code changesDefensive guard against incorrect finalizer implementations
709069b9by Olaoluwa Osuntokun+36−131 file
No security note in commit
Open full analysis →Source commit ↗
Moderate 51 AI analysisMessage 91 · Strong
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

Merge bitcoin/bitcoin#36076: psbt: preserve sighash type when merging inputs

This commit fixes a bug in Bitcoin Core's handling of Partially Signed Bitcoin Transactions (PSBTs). When two PSBTs for the same transaction were combined, the intended signature hash (sighash) type could be silently dropped depending on t…

Data-loss bug in PSBT merge logicOrder-dependent behavior in combinepsbtSighash type enforcement bypassed during finalization
4c9d55a6by Ava Chow+30−02 files
Vendor flagged security relevance
Open full analysis →Source commit ↗
Low 34 AI analysisMessage 45 · Thin
XMR Monero ProjectMonero Cryptographic librariesMoneroNode implementationsPrivacy protocols

wallet2: validate account tags before mutation

This commit fixes a bug in the Monero wallet where it would partially change account tags even when some requested account numbers did not exist. Previously, the wallet checked each account number one at a time and applied the tag immediat…

Atomicity violation in state mutationPartial state update on error pathInput validation moved before mutation
a3198687by Samy+24−02 files
No security note in commit
Open full analysis →Source commit ↗
Low 35 AI analysisMessage 68 · Adequate
BB BitBoxBitBox02 firmware BitcoinHardware wallets

oled: hold display in reset during startup

This commit fixes a display behavior issue during startup of the BitBox02 hardware wallet. Previously, when the device turned on, the screen's reset pin was left in a state that could allow leftover images or text from an earlier session t…

Information disclosure via residual display content during bootOLED reset pin sequencing hardeningDefense against stale/misleading UI state before verified firmware initializes display
cdb27835by Niklas Dusenlund+2−11 file
Vendor flagged security relevance
Open full analysis →Source commit ↗
Low 46 AI analysisMessage 73 · Adequate
EP Elements ProjectCore Lightning BitcoinLightning Network

channeld: initialize tx_sigs_allowed on startup

This commit fixes a bug where a setting that controls whether unexpected transaction signatures are allowed was not initialized when the channel daemon starts. If a peer sent such signatures before the channel was fully ready, the program …

use of uninitialized variableundefined behavior (invalid bool load)network-triggered code path
c09c4520by Erick Cestari+1−01 file
No security note in commit
Open full analysis →Source commit ↗
Moderate 58 AI analysisMessage 73 · Adequate
LDK Lightning Dev Kitrust-lightning BitcoinCryptographic librariesLightning Network

Add `Wallet::release_utxos` to free UTXOs from abandoned transactions

This commit fixes a design flaw in LDK's built-in wallet helper where coins selected for a splice-in (or other unclaimed funding) were permanently reserved in memory if the transaction was abandoned. Over repeated failed splices, all spend…

Denial-of-service via UTXO exhaustion from repeated failed splice negotiationsRisk of inability to broadcast fee-bumping/claim transactions due to lack of available UTXOsNew API surface (release_utxos) introduced to mitigate resource leak
52ab13fdby elnosh+148−43 files
Vendor flagged security relevance
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 100 · Strong
LDK Lightning Dev Kitrust-lightning BitcoinCryptographic librariesLightning Network

Drop the honggfuzz version pin from the CI fuzz job

This commit removes a fixed-version pin for the honggfuzz fuzzing tool in a continuous-integration script. The project now uses the current release of honggfuzz instead of an older pinned version. There is no change to the actual Lightning…

4a1635efby auto-pr-bot+1−51 file
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 86 · Strong
LDK Lightning Dev Kitrust-lightning BitcoinCryptographic librariesLightning Network

Run the CI fuzz job on the stable toolchain

This commit changes the Rust toolchain used in the continuous integration (CI) fuzzing job from a fixed older version (1.75) to the latest stable release. It is purely a build/test infrastructure change to fix a dependency compatibility is…

21c4ed2bby auto-pr-bot+3−32 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 100 · Strong
EP Elements ProjectCore Lightning BitcoinLightning Network

ci: fix the coverage nightly's profile handling

This commit fixes the project's internal nightly code-coverage CI workflow. It changes how test coverage files are collected, ensures the same LLVM compiler version is used to generate and merge coverage data, and uploads a Codecov-compati…

5685c9a3by cdecker+12−211 file
No security note in commit
Open full analysis →Source commit ↗
Informational 18 AI analysisMessage 73 · Adequate
EP Elements ProjectElements BitcoinBitcoin sidechainsCryptographic librariesNode implementations

init: add -norangeproofcache startup option to disable range proof cache

This commit adds a new command-line option `-norangeproofcache` that lets node operators turn off an internal performance cache used when validating confidential transaction range proofs. It is a debug/test option, not a security fix. Ther…

No security-relevant signal in commit message or diffNew debug/test startup option onlyNo validation logic change; only cache lookup/store paths are bypassed
53167b1fby Byron Hambly+13−52 files
No security note in commit
Open full analysis →Source commit ↗
Moderate 68 AI analysisMessage 83 · Strong
EP Elements ProjectElements BitcoinBitcoin sidechainsCryptographic librariesNode implementations

sigcache: harden proof cache keys with length-prefixed hashing

This commit fixes a cache-key collision bug in Elements' proof verification caches. Previously, the cache key for range proofs and surjection proofs was built by simply concatenating raw bytes, so two different sets of inputs could acciden…

Cache-key collision in proof verification cache could allow bypass of cryptographic verificationRaw concatenation of variable-length fields in cache-key constructionMissing input (vTags) in surjection-proof cache key
b0a27528by Byron Hambly+92−282 files
Vendor flagged security relevance
Open full analysis →Source commit ↗
01
Why commit watching?

Security should leave a paper trail.

A quiet fix may be responsible caution—or it may leave users unaware that their assets were ever at risk. CommitWatch preserves the evidence, adds context, and tracks whether vendors disclose, acknowledge, and learn.

Why we built this →