You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Custom SNI handling by keeping Custom SNI Domain visible/editable independently of the Protocol Tweaks mode, while still applying it only to Stealth/stunnel and WSTunnel connections.
wsnet/desktop hardening by validating values received from wsnet and applying wsnet security-audit fixes for URL construction, TLS/network handling, logging, parsing, and failover robustness.
DNS leak firewall setup by de-duplicating DNS server entries before adding Windows firewall filters on Windows.
Split tunneling so non-tunneled apps can preserve native ISP IPv6 on dual-stack networks while tunneled apps remain leak-protected on Linux.
Networking-service handling so installers avoid force-enabling NetworkManager/systemd-resolved and nmcli-dependent features degrade gracefully when unavailable on Linux.
Fixed
Local root escalation chain involving SGID helper descriptor reuse and OpenVPN custom config parser differences on Linux.
Inclusive split tunneling with WireGuard on Windows tunneling non-included traffic through the VPN.
Inclusive split tunneling on Windows blocking native ISP IPv6 for non-included apps on dual-stack networks.
HTTP Proxy settings rejecting valid high port numbers in the 63536-65535 range.
Always On+ firewall mode skipping WireGuard when a valid cached WireGuard config is available.
Always On+ unsecured-network handling disconnecting during WireGuard-to-OpenVPN fallback when no cached WireGuard config is available.
Insecure OpenVPN management interface behavior that could allow local management-port hijacking, spoofed VPN state, or credential capture.
Split tunneling extension lifecycle bugs and improved cleanup on macOS.
openSUSE Tumbleweed SSL/API validation failures caused by missing Debian-style CA bundle path.
Updated
wsnet to 1.5.29, including security-audit hardening and a fix for Linux CA bundle loading with cURL 8.21.
Custom SNI support for stunnel/wstunnel anti-censorship connections.
Cross-platform diagnostics for API connectivity login failures so logs can better distinguish DNS, routing, proxy, IPv4/IPv6, and local security-policy failures.
Improved
The Windows IKEv2 connector. A complete rewrite of the code to improve connection setup speed and connection robustness.
Anti-censorship startup and failover by supporting parallel backup domain testing in wsnet.
Firewall behavior consistency across platforms and firewall modes.
Linux firewall implementation by replacing iptables shell calls with libnftables.
Linux split tunneling so non-tunneled apps can preserve ISP IPv6 on native dual-stack networks while tunneled apps remain leak-protected.
Always On/Always On+ firewall handling with Allow LAN Traffic by disabling risky LAN allowance on mode enable and warning when LAN traffic is explicitly re-enabled.
macOS installer/update code paths and installer flow.
Linux firewall/routing fwmark handling by centralizing fwmark use and avoiding incorrect WireGuard mark behavior.
Hardening for elevated executables using Windows process mitigation APIs where applicable.
Windows compiler and linker security hardening, including Control Flow Guard and related mitigation settings.
Windows build targeting to Windows 10 2004 so newer Windows APIs can be used without changing the minimum install version.
Split tunneling error handling so startup failures can show the usual Split Tunneling failed alert on macOS.
Objective-C memory management consistency by enabling ARC uniformly across the project.
CLI-only behavior by automatically watching config file changes instead of requiring windscribe-cli preferences reload.
Dependency build integrity by pinning or verifying wstunnel and AmneziaWG prebuilt source dependencies.
Fixed
Security audit findings covering macOS signature validation, Windows WireGuard config permissions, local IPC robustness, AmneziaWG input validation, and sensitive logging paths.
Static IP OpenVPN/TCP connections prompting for credentials instead of supplying stored Static IP credentials internally.
Remembered credentials for external .ovpn custom configs not being persisted immediately across restart/reboot.
Polish free-data counter text overlapping the upgrade CTA and locations-list chevron.
Hashed-login failures caused by user accidentally including leading/trailing whitespace in their input.
WireGuard connection mode unavailable when Always On+ firewall mode is enabled and cached WireGuard connection information is available.
c-ares Windows DNS server detection regression that could leave only 127.0.0.1:53 and cause DNS resolution failures.
The Windscribe service getting stuck in the stop pending state when a stop is requested while the desktop app is running on Windows.
A possible crash when enabling Secure Hotspot after connecting the VPN on Windows.
A rare crash when launching at startup before macOS screen information is available.
Linux firewall block rule ordering so Windscribe's kill-switch block path takes precedence over UFW/third-party allow rules.
openSUSE Tumbleweed RPM install failure related to the libcap-progs dependency path.
Allow LAN traffic not applying correctly to IPv6 LAN and multicast traffic while connected on Windows.
Missing warning when split tunneling is enabled while the macOS split tunneling extension has been manually disabled.
Allow LAN traffic IPv6 behavior on macOS so ULA and multicast traffic are blocked on the VPN interface while remaining reachable on the physical LAN.
Updated
cURL to 8.21, c-ares to 1.34.7, OpenVPN to 2.7.5, OpenSSL to 4.0.1, and wsnet to 1.5.27 for security updates.
