[ctx]ctxseccontext security: attacks on the harness and context layer of AI agents, plus exploited-now news, hunting and playbooks.

← Cybersecurity News · markdown

official (@lnbits, Nov 8); one operator reported losses on their own instance; no CVE or root cause published yet

LNbits tells every operator to stop their servers immediately after a wave of attacks; patches are not out yet

  • Do now (per LNbits): stop the LNbits process and leave it off until the project publishes patches through its official channels.
  • The earlier Paywall-only precaution is superseded by the full shutdown request.
  • This is an LNbits application warning, not a Bitcoin or Lightning protocol failure. Isolate the node's admin credentials (for example LND/CLN macaroons) from the stopped web app, and do not point a public URL at LNbits again until you have applied the official updates and reviewed accounts created around the attack window.

Sources: LNbits: stop all servers immediately (Nov 8) · LNbits: disable the Paywall extension (earlier Nov 8) · Kevin Ravensberg: 2,285,545 sats withdrawn from his instance via new accounts