Download Windscribe 2.23.11

Added
- Package signing and update authenticity hardening for supported Linux packages.
Improved
- App hardening from the Fable 5 audit, including WireGuard key validation, Control D API key log redaction, IPC exposure hardening, safer logging, installer argument redaction, and package/dependency handling fixes.
- Windows helper IPC parameter validation to reduce local IPC attack surface.
- Linux helper IPC/API hardening after EGL gid-check bypass review.
- Windows IKEv2 connector stability to mitigate possible crashes.
- macOS builds against Xcode 26.5 and enabled ARC for client-common Objective-C++ code.
- Proxy Gateway privacy by no longer logging blocked destinations for HTTP and SOCKS gateway requests.
- IP Stack preference wording to clarify it applies to WireGuard only.
- Preferences title casing consistency.
- Sign Up screen helper text styling under the Password and Email fields.
- JSON/INI import consistency for proxy sharing and MAC spoofing settings.
- Debug logs by removing false positives that could mislead automated log analysis on Windows.
- Russian and Ukrainian translations in the desktop app, installer, and CLI from GitHub user WkdXeqtr.
- Belarusian translations in the desktop app, installer, and CLI from GitHub user dubovy-achvelak.
Fixed
- DLL planting vulnerability in the Windows bootstrapper and uninstaller.
- Windows installer/updater staging TOCTOU allowing the privileged helper to copy from a different source path than the one it validated.
- Local privilege escalation security vulnerability from app retaining SETGID capability after group switch on Linux.
- Possible local privilege escalation chain involving external-link opening and OpenVPN directive validation bypass.
- OpenVPN custom config filtering to handle embedded NULL/control characters consistently and reject unsafe directives.
- OpenVPN custom config parsing to prevent commented-out route-nopull / route-noexec text from disabling automatic firewall handling.
- Malformed OpenVPN inline tags bypassing custom config directive filtering.
- AmneziaWG custom WireGuard I-values allowing newline/config injection in imported custom configs.
- Custom OpenVPN device names that could bypass Linux DNS leak protection by using wildcard-style interface names.
- Split tunneling service startup failures not showing the expected user-facing warning prompt on Windows.
- A crash when clicking the menu bar icon on affected macOS 27 beta builds.
- DNS leak protection allowing pre-VPN OS DNS resolvers when DNS traffic egressed over the VPN interface on Linux.
- Always On+ firewall feature eventually showing the Ignore SSL errors prompt during blocked or delayed connectivity.
- Launch on startup mechanism may fail to apply during a reboot.
- Control D via API Key connections failing when an IPv6 bootstrap IP from Custom DNS was retained without native IPv6.
- Ignore SSL Errors runtime bypass handling to reset wsnet failovers before retrying failed requests.
- IP pinning fallback when an Advanced Parameters remote IP does not match the selected location.
- Memory leak when handling CLI IPC commands.
- Windows installer progress handling near completion when uninstalling previous components and launching the app.
- Periodic reconnects on Windows IKEv2 connections caused by transient OS status checks.
- Logout/session deletion leaving the Windscribe IKEv2 VPN profile in macOS System Settings.
- Linux address selection so IPv6-capable VPN connections do not incorrectly prefer IPv4 via Windscribe gai.conf handling.
- deb/rpm packages installing scripts or helper files with world-writable permissions.
- Data-remaining counter showing 0 bytes after an expired/blocked account state and newly logged into account has remaining data.
- Networks marked Unsecured being treated as Secured on launch, which could incorrectly trigger auto-connect.
- Imported dashed MAC spoof values showing incorrectly and reporting MAC spoofing failure even though the spoof was applied.
- IKEv2 inclusive split tunneling leaving a low-metric default tunnel route active, causing non-included traffic to route through the VPN on Windows.
- Linux IPv6 split-tunnel routes being added without the required interface name.
- Linux IPv6 DNS leak protection missing ip6tables rules for IPv6 DNS resolvers.
- Linux split-tunneling process monitor skipping proc events after the first netlink read.
- Linux split-tunneling setup failures being reported as successful.
- Persistent Ignore SSL Errors preference behavior so TLS validation bypass is runtime-only and does not survive app restart.
- Connected DNS Custom 0.0.0.0 breaking local ctrld resolver behavior while connected.
- Split tunneling disabled message handling on macOS.
Updated
- Updated wsnet to 1.5.20.
Removed
- The Contact Humans preference from the help UI.