Alby Hub critical vuln lets attackers steal funds if API exposed

This vulnerability is notable because it targets self-custodial Lightning infrastructure, where a single API exposure can translate directly into loss of funds. The narrow affected range and the single confirmed case suggest limited blast radius so far, but the real risk lies in users who may have unknowingly exposed their management API. The prompt disclosure and clear remediation path reduce uncertainty, yet the open question is whether similar exposure patterns exist across other self-hosted node software. This incident underscores the operational burden of running personal custody infrastructure, where security hygiene is as critical as software updates.