No evidence of an RCE from what I can tell, just whats set in BTCPay

I don't run BTCP, this is what I've gleaned from the patch commits, you should reach out to the BTP devs to ameliorate any other concerns.

justin_shocknet

I am more concerned about things like hsm_secret. If the attacker got code execution on the pre-2.4.2 host, they could steal the long term identities of nodes.

We need more details about what exactly an attacker can do. In the most critical case we will need to rotate ALL secrets, and burn down nodes.

bitcoin

Critical: BTCPay Exploit in the wild

I am more concerned about things like hsm_secret. If the attacker got code execution on the pre-2.4.2 host, they could steal the long term identities of nodes.

We need more details about what exactly an attacker can do. In the most critical case we will need to rotate ALL secrets, and burn down nodes.