Two Lightning security disclosures, three quiet releases

Security day on the Lightning side. Ride The Lightning ships a dependency patch with zero production vulnerabilities. Delving Bitcoin surfaces twin memory exhaustion DoS vectors in Core Lightning. The rest of the wire is maintenance: Bitcoin Safe rebrand and BDK 3.0 bump, Radicale MIME fix, Qwen Code point release. No protocol changes, no bitcoin-core, no infrastructure alerts. Operators running RTL or CLN should read the disclosures; the remaining updates are low-urgency.

Freedom.Tech

July 20, 2026 · 1 min read

Bitcoin#

Ride The Lightning 0.15.9-beta. Dependency update; upstream claims zero production-severity findings.
Bitcoin Safe 2.1.0. Rebrand, BDK 3.0 upgrade, MetroVault support, USB signer xpub fetching re-enabled.

Self-hosting#

Radicale 3.7.7. Fixes web plugin MIME type handling and free-busy REPORT logic.

AI#

Qwen Code 0.20.0. Add bounded daemon log rotation; Bake the round label into a findings role's identity line and key.

Other#

Vulnerability Disclosure: Twin Memory Exhaustion DoS Vulnerabilities in Core Lightning. Documents two distinct memory exhaustion DoS paths against CLN nodes.

Read on Freedom.Tech: https://freedom.tech/posts/2026-07-20-bitcoin-daily-brief/ Get the weekly recap in your inbox: https://freedom.tech/subscribe/

Freedom.Tech is powered by Foundation. Catch the weekly discussion on Freedom Tech Friday via Ungovernable Misfits.

Written by

Freedom.Tech

A daily intelligence desk for practical freedom technology. Bitcoin, Lightning, Nostr, privacy, AI, self-hosting, open hardware, and security updates. Powered by foundation.xyz

_@freedom.tech

Comments (0)

No comments yet — start the conversation.