A Lightning CVE and the Tor Browser 16.0 jump

The dominant signal this week was a Lightning and Bitcoin wallet patch wave running in parallel with the tail end of the CA-compromise cleanup. Lightning Terminal shipped CVE-2026-98432 alongside bundled lnd, taproot-assets, loop, pool, and faraday updates, while Eclair, Ride The Lightning, and Envoy all pushed security-hardening releases in the same window. Sparrow Wallet's 2.5.6 release explicitly removed the eMudhra root certificates from its bundled store, confirming that cleanup is still working through the Bitcoin wallet layer a week after it first surfaced. The secondary signal was volume: AI again dominated story count at 62, driven by routine llama.cpp, langchain, and Hugging Face Transformers churn rather than anything structural. Self-hosting held steady with CalDAV and monitoring tooling (Radicale, DAVx5, Uptime Kuma, ntfy) shipping security-flagged point releases. Nostr stayed the quietest beat at 7 stories, mostly client patch releases with no CVEs. Bitcoin Core also shipped parallel 29.5 and 30.4 minor releases, keeping both maintained branches current. Unlike last week's single shared dependency failure, this week reads as normal maintenance cadence with one genuine CVE at the Lightning application layer.

Freedom.Tech

1. November 2026November 1, 2026 · 8 Min. Lesezeit8 min read

Patch board#

This week's patch board centers on a single disclosed CVE, CVE-2026-98432 in Lightning Terminal, bundled with a full update of lnd, loop, pool, and faraday. Around it sits a cluster of self-described hardening releases without disclosed CVEs: Eclair, Ride The Lightning, Envoy, and Jan all flagged security work in their release notes. The eMudhra certificate cleanup continues to surface downstream, this week in Sparrow Wallet's bundled certificate store. Operators running Lightning node management stacks should prioritize the LiT update; the hardening-only releases can follow on normal cadence.

Weekly threads#

Lightning app layer absorbs a CVE and hardens broadly#

Lightning Terminal 0.17.10 shipped CVE-2026-98432 bundled with lnd v0.21.6-beta, taproot-assets, loop, pool, and faraday updates. Eclair 0.14.6 and Ride The Lightning 0.15.16-beta both describe themselves explicitly as security hardening releases in the same week, the latter clearing every open Dependabot alert. Operators running any Lightning node management stack have three separate hardening releases to reconcile against one disclosed CVE.

eMudhra cleanup still rippling into wallets#

Sparrow Wallet 2.5.6 removed the eMudhra root certificates from its bundled Java certificate store this week, a cleanup step that started in prior weeks across self-hosting and AI tooling. The same release also bundled an updated Tor client, suggesting wallet maintainers are batching certificate and network-stack hygiene together rather than shipping piecemeal.

StartOS ships a coordinated multi-component update#

StartOS 0.4.1, start-cli 2.5.2, start-registry 1.2.1, and Start SDK 3.1.1 all shipped within the same week, touching symlink handling, gpg-signed OS release verification, and subcontainer image resolution together. Operators running StartOS servers should treat this as one coordinated update rather than four independent patches.

Release board#

Privacy#

Self-hosting#

AI#

Nostr#

Bitcoin#

Also shipped: Ashigaru Desktop 1.5.1.

What to watch#

By the numbers#

Top beats this week

Read on Freedom.Tech: https://freedom.tech/posts/2026-11-01-weekly-recap/ Get the weekly recap in your inbox: https://freedom.tech/subscribe/

Freedom.Tech is powered by Foundation. Catch the weekly discussion on Freedom Tech Friday via Ungovernable Misfits.

#foundation#freedomtech

Written by

Freedom.Tech

A daily intelligence desk for practical freedom technology. Bitcoin, Lightning, Nostr, privacy, AI, self-hosting, open hardware, and security updates. Powered by foundation.xyz

Comments

No comments yet. Start the conversation.

Contents

5 sections

  1. Patch board
  2. Weekly threads
  3. Release board
  4. What to watch
  5. By the numbers