BTCPay Server flags critical, in-the-wild exploit; users told to upgrade to v2.4.2 immediately

BTCPay Server issued an urgent security notice on Aug. 7, telling operators to update to version 2.4.2 after identifying a critical vulnerability that is being actively exploited and could "result in the loss of funds," according to the project's official X account. What operators should do now - Apply the update immediately via the built-in maintenance path: Admin Dashboard → Server → Maintenance → Update. - Verify the footer shows v2.4.2. - If you can't patch right away, shut down the BTCPay Server instance until the fixed release can be installed. The team recommends taking affected servers offline to prevent further unauthorized access. What's confirmed so far BTCPay Server has categorized the issue as critical and says exploitation is already underway. The project has not disclosed which prior versions are affected, the attack vector, how many servers may have been compromised, or whether any funds were stolen. No indicators of compromise or technical write-up have been released, leaving operators with limited guidance on how to determine if they were targeted. Why it matters BTCPay Server is an open-source, self-hosted payment processor that allows merchants to accept Bitcoin and Lightning payments on infrastructure they control. The non-custodial setup reduces dependence on third parties, but places the responsibility for patching and security on individual operators. A compromised deployment could expose payment workflows or other sensitive server functions, depending on the vulnerability. Wider security backdrop The disclosure comes after a recent incident involving Zeus Wallet, which temporarily took systems offline following a cyberattack. Zeus said no customer funds were lost and reported no Lightning node software vulnerability in its investigation. There is no evidence the two events are connected. Security scrutiny across the Bitcoin ecosystem has been increasing. The volunteer Bitcoin Red Team recently reported nearly 5,000 potential issues across 390 projects, including 720 items rated high or critical. Bottom line Treat this as an emergency response, not routine maintenance: upgrade to v2.4.2 through the official server interface, or power down the server until you can patch. Operators should also review server activity for signs of unauthorized access, keeping in mind that formal compromise indicators have not yet been provided. Additional technical details may be released after a sufficient share of systems have been updated and disclosure no longer raises risk for unpatched instances.