BTCPay Server, the open-source platform that lets merchants accept Bitcoin without relying on third-party payment processors, issued an emergency advisory on August 7 warning users of a critical security vulnerability that is already being exploited in the wild.
The instructions were blunt: update to version 2.4.2 right now, or shut your server down entirely.
What happened and what users need to do
The BTCPay Server team disclosed the vulnerability just minutes before the warning spread across social media, a timeline that suggests the team prioritized getting the fix out over crafting a polished announcement.
Users running any version prior to 2.4.2 are potentially exposed. The upgrade can be performed through the admin dashboard, and the team advised verifying the update by checking that “2.4.2” appears in the footer of the application after installation.
