Buried mid-changelog sits the line that matters most: 2.5.6 ports Electrum's fix for CVE-2026-117601. A malicious server can swallow your just-broadcast transaction and answer with a conflicting fake. Its output address was ground to match the last four characters of yours, so a fee bump on that fake pays the attacker. Electrum has two user reports from the wild, one of them a real loss. The release text should say that out loud, because the fix only validates is_mine inputs. A fake incoming payment can still appear unconfirmed, so a receipt is not settled until it is mined. Running your own server remains the other half.