Subscribe
Back to News / Development

BTCPay Server Releases V2.4.3-RC4 Security Update – Urgent Upgrade Recommended

OR
BY ORANGEMAN
Verified Contributor
| 4H AGO | 3 MIN READ |
BTCPay Server has released version 2.4.3-rc4, a critical security update addressing vulnerabilities reported by security researchers.
DEVELOPMENT INFRASTUCTURE LIGHTNING NETWORK

On August 13, 2026, the BTCPay Server team announced the public release of BTCPay Server v2.4.3-rc4. This is a focused security update that addresses multiple vulnerabilities reported by the Bitcoin Red Team, Project Loupe, Magic Grants, Premai.io, and independent researchers.

The release follows several days of continuous development, review, and testing. To deliver the fixes as quickly as possible, the team built the update from a temporary private security repository and is now making the Docker image publicly available.

Key Details of BTCPay Server v2.4.3-rc4

  • This is a release candidate (RC). Minor bugs may still exist.
  • NFC is now opt-in.
  • The Phoenixd plugin is temporarily incompatible with this version.
  • Behavioral changes will be fully documented in the final release notes.
  • If no significant issues are reported, the team plans to tag the stable v2.4.3 and fully open-source the code within approximately 48 hours.
Despite its RC status, the BTCPay Server team strongly recommends that all users upgrade immediately.
BTCPay Server has released version 2.4.3-rc4, a critical security update addressing vulnerabilities reported by security researchers.

How to Update Your BTCPay Server Instance

Operators can update using the standard process:
  1. Go to Server Settings > Maintenance > Update, or
  2. Run the command btcpay-update.sh from the command line (on the server).
Users who previously updated to 2.4.2 after the earlier critical vulnerability should still apply this newer security release.

Background: Recent Security Focus

This update comes shortly after BTCPay Server released version 2.4.2 in early August 2026. That earlier patch fixed a critical vulnerability (actively exploited in some cases) that allowed attackers to obtain LND admin macaroon credentials on affected instances, potentially exposing connected Lightning Network wallets.

The project has responded transparently, published security advisories, supported responsible disclosure with donations to researchers, and coordinated a recovery bounty (up to 3 BTC) for funds affected by the prior exploit.

The new v2.4.3-rc4 continues this priority on hardening the open-source, self-hosted Bitcoin payment processor.

Recommendations for Operators

  • Upgrade as soon as possible, especially if you run LND or accept Lightning payments.
  • After updating, monitor your instance and report any issues to the BTCPay Server team.
  • Review the official security advisory and blog posts on the BTCPay Server website for full technical context from the earlier incident.
  • Keep regular backups and follow best practices for self-hosted Bitcoin infrastructure.

BTCPay Server remains one of the leading free, open-source, and self-hosted solutions for accepting Bitcoin and Lightning payments without intermediaries or fees. Rapid response to security reports helps maintain trust in the broader Bitcoin merchant ecosystem.

For the latest information, follow the official @BtcpayServer account on X and check the BTCPay Server documentation and blog.

Sources:

Official announcement by @BtcpayServer on August 13, 2026; prior BTCPay Server security advisories and related coverage.

ENJOYED THIS ARTICLE?Support the authorSend a zap over Lightning or on-chain
BITCOINBITCOIN DEVELOPMENT