A flaw in Core Lightning's channel-close mechanism was patched in version 26.06.8, released September 22, that could allow a peer to broadcast a revoked channel state without incurring the intended penalty for cheating. Bitcoin Optech detailed the vulnerability on September 25, explaining that older builds of the software might treat a funding transaction matching previously recorded shutdown scripts as a cooperative close, even when the state being broadcast was revoked. This condition depended on specific channel configurations, particularly when an upfront shutdown script had not been defined at channel opening. In such cases, a peer could reference the output script of a revoked commitment in a shutdown message and later abandon the cooperative close to broadcast the old state. Matching transaction outputs alone could make the transaction appear legitimate, circumventing the penalty enforcement mechanism. The fix modifies the software to verify a transaction's locktime and sequence encoding before evaluating outputs as a potential mutual close. The vulnerability did not constitute a confirmed theft but represented a potential path to evade penalty enforcement under narrow conditions. This issue was confined to Core Lightning's channel-handling logic and did not alter Bitcoin's base-layer protocol rules. Operators running versions prior to 26.06.8 are advised to update, as the flaw could be exploited in channels meeting the specific criteria. The project also noted that Docker images served under tags from August 28 to September 1 had reported version 26.06.7 without including its security fixes, requiring users to re-pull images with corrected digests. The patch history shows that v26.06.7 was released August 28, its source code was embargoed until September 11, and the fix was merged into the main branch on September 15 before the final release. Core Lightning emphasized that the revoked-close bypass required the presence of the shutdown-script condition, meaning not all channels were equally at risk.