Version 2.23 build 12 du 11/07/2026- Fixed : WireGuard connection may hang/timeout due to phantom ROOT/WireGuard device nodes created by the Windows feature update process.
Version 2.23 build 11 du 08/07/2026- Added : Package signing and update authenticity hardening for supported Linux packages.
- Improved : App hardening from the Fable 5 audit, including WireGuard key validation, Control D API key log redaction, IPC exposure hardening, safer logging, installer argument redaction, and package/dependency handling fixes.
- Improved : Windows helper IPC parameter validation to reduce local IPC attack surface.
- Improved : Windows IKEv2 connector stability to mitigate possible crashes.
- Improved : Proxy Gateway privacy by no longer logging blocked destinations for HTTP and SOCKS gateway requests.
- Improved : IP Stack preference wording to clarify it applies to WireGuard only.
- Improved : Preferences title casing consistency.
- Improved : Sign Up screen helper text styling under the Password and Email fields.
- Improved : JSON/INI import consistency for proxy sharing and MAC spoofing settings.
- Improved : Debug logs by removing false positives that could mislead automated log analysis on Windows.
- Improved : Russian and Ukrainian translations in the desktop app, installer, and CLI from GitHub user WkdXeqtr.
- Improved : Belarusian translations in the desktop app, installer, and CLI from GitHub user dubovy-achvelak.
- Fixed : DLL planting vulnerability in the Windows bootstrapper and uninstaller.
- Fixed : Windows installer/updater staging TOCTOU allowing the privileged helper to copy from a different source path than the one it validated.
- Fixed : Local privilege escalation security vulnerability from app retaining SETGID capability after group switch on Linux.
- Fixed : Possible local privilege escalation chain involving external-link opening and OpenVPN directive validation bypass.
- Fixed : OpenVPN custom config filtering to handle embedded NULL/control characters consistently and reject unsafe directives.
- Fixed : OpenVPN custom config parsing to prevent commented-out route-nopull / route-noexec text from disabling automatic firewall handling.
- Fixed : Malformed OpenVPN inline tags bypassing custom config directive filtering.
- Fixed : AmneziaWG custom WireGuard I-values allowing newline/config injection in imported custom configs.
- Fixed : Custom OpenVPN device names that could bypass Linux DNS leak protection by using wildcard-style interface names.
- Fixed : Split tunneling service startup failures not showing the expected user-facing warning prompt on Windows.
- Fixed : A crash when clicking the menu bar icon on affected macOS 27 beta builds.
- Fixed : DNS leak protection allowing pre-VPN OS DNS resolvers when DNS traffic egressed over the VPN interface on Linux.
- Fixed : Always On+ firewall feature eventually showing the Ignore SSL errors prompt during blocked or delayed connectivity.
- Fixed : Launch on startup mechanism may fail to apply during a reboot.
- Fixed : Control D via API Key connections failing when an IPv6 bootstrap IP from Custom DNS was retained without native IPv6.
- Fixed : Ignore SSL Errors runtime bypass handling to reset wsnet failovers before retrying failed requests.
- Fixed : IP pinning fallback when an Advanced Parameters remote IP does not match the selected location.
- Fixed : Memory leak when handling CLI IPC commands.
- Fixed : Windows installer progress handling near completion when uninstalling previous components and launching the app.
- Fixed : Periodic reconnects on Windows IKEv2 connections caused by transient OS status checks.
- Fixed : Logout/session deletion leaving the Windscribe IKEv2 VPN profile in macOS System Settings.
- Fixed : Linux address selection so IPv6-capable VPN connections do not incorrectly prefer IPv4 via Windscribe gai.conf handling.
- Fixed : deb/rpm packages installing scripts or helper files with world-writable permissions.
- Fixed : Data-remaining counter showing 0 bytes after an expired/blocked account state and newly logged into account has remaining data.
- Fixed : Networks marked Unsecured being treated as Secured on launch, which could incorrectly trigger auto-connect.
- Fixed : Imported dashed MAC spoof values showing incorrectly and reporting MAC spoofing failure even though the spoof was applied.
- Fixed : IKEv2 inclusive split tunneling leaving a low-metric default tunnel route active, causing non-included traffic to route through the VPN on Windows.
- Fixed : Persistent Ignore SSL Errors preference behavior so TLS validation bypass is runtime-only and does not survive app restart.
- Fixed : Connected DNS Custom 0.0.0.0 breaking local ctrld resolver behavior while connected.
- Fixed : Split tunneling disabled message handling on macOS.
- Updated : Updated wsnet to 1.5.20.
- Removed : The Contact Humans preference from the help UI.
(0 votes)
