An active exploit in August 2026 targeted BTCPay Server installations, exposing administrator credentials and allowing attackers to drain funds from some connected Lightning nodes.