BTCPay Server, a widely used self-hosted Bitcoin payment processing platform, has issued a formal warning to its user base regarding a critical security flaw. According to the project, this vulnerability is not merely theoretical; it is currently being leveraged by malicious actors in active attacks. The platform serves as a vital tool for merchants and organizations looking to accept Bitcoin payments without relying on third-party intermediaries, making the integrity of its code essential for user security.

While the specific technical details of the exploit have been limited to prevent further abuse, the project's maintainers have released patches and are strongly advising all self-hosted instance administrators to perform updates immediately. The nature of the flaw suggests that attackers could potentially compromise the payment processing flow or gain unauthorized access to server environments. Because BTCPay Server is self-hosted, the responsibility for applying these security updates falls directly on the individual or business operating the instance, rather than a centralized service provider. Users who fail to update their systems remain exposed to the ongoing exploitation attempts. The team has provided documentation on their official channels to guide administrators through the patching process to ensure their payment gateways remain secure.