Four Core Lightning Docker tags delivered binaries without the security fixes associated with v26.06.7 while reporting that version at startup. The affected tags were v26.06.7, latest, v26.06.7-vls and latest-vls, and the faulty images were served between Aug. 28 at 16:04 UTC and Sept. 1, with no precise end time given. An automated build process published them from a placeholder tag. Maintainers have replaced the images and removed the incorrect manifest references, but operators who retained a faulty image must compare its image digest, the hash identifying a specific container image, with the corrected values rather than relying on the startup version. The corrected digests are sha256:0421a5f0d1b2e1ad639edfa17d777816040e3850d91bae7f2d32186d9c1e6da4 for v26.06.7 and latest, and sha256:6a5e05c13a65613f8c0fe3830c60248a6724e7206c1c23dd26ac2e98a3e72c1f for the VLS tags. Operators can inspect the local standard image with the supplied Docker command and pull a replacement if the digest differs. VLS users must use the separate VLS digest, set VLS_CLN_VERSION to v26.06.7 and retain signer version VLS v0.14.0; otherwise remote_hsmd_socket will refuse to start. Users pinned to v26.06.6 or earlier avoided the packaging error, although they do not have the new v26.06.7 security fixes. The Aug. 28 release imposed a 14-day embargo on its source, with disclosure planned for Sept. 11; as of Sept. 8, publication remained pending to give operators time to upgrade before potential attackers could reverse-engineer the fixes. Maintainers also warned that GitHub's automatically attached source archives are not the v26.06.7 source and will not build the advertised patched binaries.