According to CoinMeta, Wu said that btcpay and server have disclosed a serious vulnerability that is being actively exploited, which may lead to user fund losses. Users are urged to upgrade to version 2.4.2 immediately. If upgrading is not possible for the time being, it is recommended to disable btcpay and server to prevent unauthorized access. The official also suggests that after completing the upgrade, users should regenerate macaroons and macaroons.db, and update the authentication strings for other Lightning Network backends. If users have created on-chain hot wallets in btcpay, they should transfer their funds out and recreate their wallets as well.