BTCPay Server warns active exploit may drain funds

BTCPay Server has urged users to install version 2.4.2 immediately after discovering that attackers are actively exploiting a critical vulnerability that could lead to stolen funds. Summary BTCPay Server v2.4.2 contains the required security update. The vulnerability is already being actively exploited, according to the project. Operators unable to update should shut down their servers immediately. BTCPay Server has not disclosed the attack method or total financial losses. BTCPay Server tells users to install v2.4.2 BTCPay Server issued the warning through its official X account on Aug. 7, describing the vulnerability as critical and saying successful exploitation could result in the loss of funds. The project instructed server administrators to open the Admin Dashboard and navigate to Server, Maintenance and Update. Operators should then confirm that the version number displayed in the server footer reads 2.4.2. “There is a critical vulnerability being actively exploited on BTCPay Server, which can result in the loss of funds,” the project said. Users who cannot complete the update immediately have been told to turn off their BTCPay Server until the patched version can be install...