Windscribe ทุกเวอร์ชันและเวอร์ชันเก่า

Fixed
- Fixed app crashes on startup when the user profile path contains non-ASCII characters.

Added
- Custom SNI support for stunnel/wstunnel anti-censorship connections.
- Cross-platform diagnostics for API connectivity login failures so logs can better distinguish DNS, routing, proxy, IPv4/IPv6, and local security-policy failures.
- A SECURITY.md document.
Improved
- The Windows IKEv2 connector. A complete rewrite of the code to improve connection setup speed and connection robustness.
- Anti-censorship startup and failover by supporting parallel backup domain testing in wsnet.
- Firewall behavior consistency across platforms and firewall modes.
- Always On/Always On+ firewall handling with Allow LAN Traffic by disabling risky LAN allowance on mode enable and warning when LAN traffic is explicitly re-enabled.
- Hardening for elevated executables using Windows process mitigation APIs where applicable.
- Windows compiler and linker security hardening, including Control Flow Guard and related mitigation settings.
- Windows build targeting to Windows 10 2004 so newer Windows APIs can be used without changing the minimum install version.
- macOS installer/update code paths and installer flow.
- Split tunneling error handling so startup failures can show the usual Split Tunneling failed alert on macOS.
- CLI-only behavior by automatically watching config file changes instead of requiring windscribe-cli preferences reload.
- Custom SNI handling by keeping Custom SNI Domain visible/editable independently of the Protocol Tweaks mode, while still applying it only to Stealth/stunnel and WSTunnel connections.
- wsnet/desktop hardening by validating values received from wsnet and applying wsnet security-audit fixes for URL construction, TLS/network handling, logging, parsing, and failover robustness.
- DNS leak firewall setup by de-duplicating DNS server entries before adding Windows firewall filters on Windows.
- Split tunneling so non-tunneled apps can preserve native ISP IPv6 on dual-stack networks while tunneled apps remain leak-protected on Linux.
- Installer and uninstaller logging on Windows.
- The ConnectionManager sub-system.
- WireGuard stale-handshake detection.
- Connection failed messaging when IKEv2 (RAS) services are unavailable.
- API retry access to use bounded per-resource exponential back-off, starting at 1 second and doubling to a 5-minute cap with jitter.
- Belarusian translations in the GUI, installer and CLI from GitHub user dubovy-achvelak.
- Dependency build integrity by pinning or verifying wstunnel and AmneziaWG prebuilt source dependencies.
- Logging when modifications to the Windows hosts file fail during IKEv2 connect/disconnect.
- Networking-service handling so installers avoid force-enabling NetworkManager/systemd-resolved and nmcli-dependent features degrade gracefully when unavailable on Linux.
- Linux firewall/routing fwmark handling by centralizing fwmark use and avoiding incorrect WireGuard mark behavior.
- Linux firewall implementation by replacing iptables shell calls with libnftables.
- Linux split tunneling so non-tunneled apps can preserve ISP IPv6 on native dual-stack networks while tunneled apps remain leak-protected.
- Objective-C memory management consistency by enabling ARC uniformly across the project.
Fixed
- Local privilege escalation vulnerability caused by a race condition in the staged macOS updater bundle.
- Local privilege escalation vulnerability caused by a replaceable installer archive on macOS.
- Local privilege escalation vulnerability caused by inherited SUID/SGID bits in staged updater bundle on macOS.
- Local privilege escalation vulnerability caused by SGID helper descriptor reuse and OpenVPN custom config parser differences on Linux.
- Local privilege escalation vulnerability caused by OpenVPN inline-parser differences and root-execution-capable directives in custom OpenVPN configs.
- Local privilege escalation vulnerability caused by an embedded NULL in a custom config coercing OpenVPN to load a malicious plug-in.
- Local privilege escalation vulnerability caused b

Fixed
- WireGuard connection may hang/timeout due to phantom ROOT/WireGuard device nodes created by the Windows feature update process.

Added
- Package signing and update authenticity hardening for supported Linux packages.
Improved
- App hardening from the Fable 5 audit, including WireGuard key validation, Control D API key log redaction, IPC exposure hardening, safer logging, installer argument redaction, and package/dependency handling fixes.
- Windows helper IPC parameter validation to reduce local IPC attack surface.
- Linux helper IPC/API hardening after EGL gid-check bypass review.
- Windows IKEv2 connector stability to mitigate possible crashes.
- macOS builds against Xcode 26.5 and enabled ARC for client-common Objective-C++ code.
- Proxy Gateway privacy by no longer logging blocked destinations for HTTP and SOCKS gateway requests.
- IP Stack preference wording to clarify it applies to WireGuard only.
- Preferences title casing consistency.
- Sign Up screen helper text styling under the Password and Email fields.
- JSON/INI import consistency for proxy sharing and MAC spoofing settings.
- Debug logs by removing false positives that could mislead automated log analysis on Windows.
- Russian and Ukrainian translations in the desktop app, installer, and CLI from GitHub user WkdXeqtr.
- Belarusian translations in the desktop app, installer, and CLI from GitHub user dubovy-achvelak.
Fixed
- DLL planting vulnerability in the Windows bootstrapper and uninstaller.
- Windows installer/updater staging TOCTOU allowing the privileged helper to copy from a different source path than the one it validated.
- Local privilege escalation security vulnerability from app retaining SETGID capability after group switch on Linux.
- Possible local privilege escalation chain involving external-link opening and OpenVPN directive validation bypass.
- OpenVPN custom config filtering to handle embedded NULL/control characters consistently and reject unsafe directives.
- OpenVPN custom config parsing to prevent commented-out route-nopull / route-noexec text from disabling automatic firewall handling.
- Malformed OpenVPN inline tags bypassing custom config directive filtering.
- AmneziaWG custom WireGuard I-values allowing newline/config injection in imported custom configs.
- Custom OpenVPN device names that could bypass Linux DNS leak protection by using wildcard-style interface names.
- Split tunneling service startup failures not showing the expected user-facing warning prompt on Windows.
- A crash when clicking the menu bar icon on affected macOS 27 beta builds.
- DNS leak protection allowing pre-VPN OS DNS resolvers when DNS traffic egressed over the VPN interface on Linux.
- Always On+ firewall feature eventually showing the Ignore SSL errors prompt during blocked or delayed connectivity.
- Launch on startup mechanism may fail to apply during a reboot.
- Control D via API Key connections failing when an IPv6 bootstrap IP from Custom DNS was retained without native IPv6.
- Ignore SSL Errors runtime bypass handling to reset wsnet failovers before retrying failed requests.
- IP pinning fallback when an Advanced Parameters remote IP does not match the selected location.
- Memory leak when handling CLI IPC commands.
- Windows installer progress handling near completion when uninstalling previous components and launching the app.
- Periodic reconnects on Windows IKEv2 connections caused by transient OS status checks.
- Logout/session deletion leaving the Windscribe IKEv2 VPN profile in macOS System Settings.
- Linux address selection so IPv6-capable VPN connections do not incorrectly prefer IPv4 via Windscribe gai.conf handling.
- deb/rpm packages installing scripts or helper files with world-writable permissions.
- Data-remaining counter showing 0 bytes after an expired/blocked account state and newly logged into account has remaining data.
- Networks marked Unsecured being treated as Secured on launch, which could incorrectly trigger auto-connect.
- Imported dashed MAC spoof values showing incorrectly and reporting MAC spoofing failure even though the spoof was applied.
- IKEv2 

Added
- A 'ports' command to the CLI.
- Belarusian (Taraškievica) localization. Community contribution by dubovy-achvelak.
- Support for the new server list v2 API.
Improved
- Filtering of potentially malicious directives in OpenVPN custom configs to prevent a local privilege escalation.
- "No P2P" icon to display per-city (datacenter) instead of per-country in the locations list.
- BFE service status detection on Windows when SCM access is restricted from unelevated processes.
- WireGuard PersistentKeepalive to use a value of 25 on all platforms.
- HTTP ping to use IP address rather than hostname.
- Field validation for custom WireGuard config import.
- Non-critical scriptlet commands on Linux to be optional to prevent failures when reinstalling or upgrading.
Fixed
- Application blocked by TLS fingerprinting in Russia.
- AmneziaWG custom configs with valid H1-H4 ranges rejected by the security validator.
- Possible local privilege escalation in the helper due to insufficient parameter validation before executing shell commands on macOS and Linux. We thank Johan Wahyudi for responsibly disclosing this issue.
- IPC frame bounds checking to reject malformed or oversized messages.
- Security vulnerability in ctrld command argument processing on macOS and Linux.
- WireGuard custom config IP/CIDR validation to prevent command injection via crafted .conf files on Linux.
- Command injection in CLI update handler on Linux.
- Possible local privilege escalation and TOCTOU exploits in the macOS helper and installer.
- Possible local privilege escalation and TOCTOU exploits in the Linux helper.
- Potential privilege escalation during app update process on Linux.
- WireGuard service may start then terminate immediately in a loop after wake from sleep on Windows.
- Possible app crash when initiating an IKEv2 connection on Windows.
- Potential deadlock at app start.
- Factory reset does not fully reset preferences on macOS.
- Call continuity doesn't work with firewall enabled on macOS.
- OpenVPN TCP fails to connect when LAN proxy feature is enabled on macOS.
- Multicast traffic not working on split tunneled apps on macOS.
- Server sub-menus for the locations list in the OS tray menu should have a delay before being displayed.
- Protocol indicates "WireGuard" while disconnected and selected location is an OpenVPN custom config.
- WireGuard key limit dialog overlaps notification banners on app launch.
- Standard/hashed login text overlaps when language set to Belarusian.
- wsnet receiving system language rather than user's preferred language.
- News feed title is clipped and entry height miscalculated when entry is expanded.
- Location list hover states broken after clicking main window.
- Third-party custom config may no longer pass tunnel test.
- Dropdown menus in Preferences scrolling to the wrong position.
- El Salvador flag icon.
- App does not consistently connect to the specific server that has the user's pinned IP.
- Purchased ALC locations cannot be selected.
- Unnecessary VPN reconnection when switching between WiFi access points on the same network on macOS and Linux.
- An app crash when on macOS when all app sessions are cleared via the website account page.
- A potential crash while reinstalling the app on macOS.
- A crash when interacting with credential fields on macOS.
- P2P indicators not shown for premium locations.
- Cannot connect to purchased individual locations because the UI shows them as premium-only.
- Cannot connect with custom configs requiring credentials.
- Bridge API session tokens not being cleared during logout and persistent settings cleanup.
- Potential use-after-free crash when API handles outlive global wsnet teardown.
- Advanced parameters not parsed after being written on Linux.
- WireGuard reconnect fails after plan downgrade until app restart.
- Protocol Tweaks toggle not enabling during fresh install on a Russian network.
- Location nickname may be corrupted when best location changes.
- Incorrect kn

Added
- A 'ports' command to the CLI.
- Belarusian (Taraškievica) localization. Community contribution by dubovy-achvelak.
- Support for the new server list v2 API.
Improved
- Filtering of potentially malicious directives in OpenVPN custom configs to prevent a local privilege escalation.
- "No P2P" icon to display per-city (datacenter) instead of per-country in the locations list.
- BFE service status detection on Windows when SCM access is restricted from unelevated processes.
- WireGuard PersistentKeepalive to use a value of 25 on all platforms.
- HTTP ping to use IP address rather than hostname.
- Field validation for custom WireGuard config import.
- Non-critical scriptlet commands on Linux to be optional to prevent failures when reinstalling or upgrading.
Fixed
- Possible local privilege escalation in the helper due to insufficient parameter validation before executing shell commands on macOS and Linux. We thank Johan Wahyudi for responsibly disclosing this issue.
- IPC frame bounds checking to reject malformed or oversized messages.
- Security vulnerability in ctrld command argument processing on macOS and Linux.
- WireGuard custom config IP/CIDR validation to prevent command injection via crafted .conf files on Linux.
- Command injection in CLI update handler on Linux.
- Possible local privilege escalation and TOCTOU exploits in the macOS helper and installer.
- Possible local privilege escalation and TOCTOU exploits in the Linux helper.
- Potential privilege escalation during app update process on Linux.
- WireGuard service may start then terminate immediately in a loop after wake from sleep on Windows.
- Possible app crash when initiating an IKEv2 connection on Windows.
- Potential deadlock at app start.
- Factory reset does not fully reset preferences on macOS.
- Call continuity doesn't work with firewall enabled on macOS.
- OpenVPN TCP fails to connect when LAN proxy feature is enabled on macOS.
- Multicast traffic not working on split tunneled apps on macOS.
- Server sub-menus for the locations list in the OS tray menu should have a delay before being displayed.
- Protocol indicates "WireGuard" while disconnected and selected location is an OpenVPN custom config.
- WireGuard key limit dialog overlaps notification banners on app launch.
- Standard/hashed login text overlaps when language set to Belarusian.
- wsnet receiving system language rather than user's preferred language.
- News feed title is clipped and entry height miscalculated when entry is expanded.
- Location list hover states broken after clicking main window.
- Third-party custom config may no longer pass tunnel test.
- Dropdown menus in Preferences scrolling to the wrong position.
- El Salvador flag icon.
- App does not consistently connect to the specific server that has the user's pinned IP.
- Purchased ALC locations cannot be selected.
- Unnecessary VPN reconnection when switching between WiFi access points on the same network on macOS and Linux.
- An app crash when on macOS when all app sessions are cleared via the website account page.
- A potential crash while reinstalling the app on macOS.
- A crash when interacting with credential fields on macOS.
- P2P indicators not shown for premium locations.
- Cannot connect to purchased individual locations because the UI shows them as premium-only.
- Cannot connect with custom configs requiring credentials.
- Bridge API session tokens not being cleared during logout and persistent settings cleanup.
- Potential use-after-free crash when API handles outlive global wsnet teardown.
- Advanced parameters not parsed after being written on Linux.
- WireGuard reconnect fails after plan downgrade until app restart.
- Protocol Tweaks toggle not enabling during fresh install on a Russian network.
- Location nickname may be corrupted when best location changes.
- Incorrect knowledge base URL in Help window.
- Change protocol screen maximizes vertically after moving it.
- Linux CLI does not log the user out when all

Added
- AmneziaWG advanced anti-censorship support.
- In-app user registration functionality.
- Sound preview for sound notifications in preferences.
- Favourite locations to preferences import/export.
Improved
- Adapter network identification state detection (identified, identifying, unidentified) on Windows.
- App (helper) to support running on Windows Server 2019/2022 without requiring the Wireless LAN Service to be installed.
- Network options description and added help link.
- Additional Slovak translations from GitHub user kubalav.
- Spanish translations.
Fixed
- App may crash during launch on macOS.
- IKEv2 may get stuck after waking from sleep on Windows.
- IP utilities sometimes not available after changing from custom config to regular location.
- IP pinning and rotation features may be disabled when using Circumvent Censorship on Windows.
- WireGuard may fail to reconnect on PC wake when using Circumvent Censorship on Windows.
- Clicking "Login" from Preferences while logged out goes to Welcome screen instead.
- Rotating the MAC address causing the tunnel test phase to get stuck.
- e-mail field should not show for hashed accounts.
- 'Clear Wi-Fi History' feature not clearing WLAN profiles on Windows.
- /etc/gai.conf changes not undone after disconnection on Linux.
- ip6tables rule ordering on Linux.
- Updater may get stuck if gnome-session-service doesn't reap the old process on Linux.
- DPI scaling issues in login/signup UI.
- A failed assertion at app start.
- Incorrect window ordering when returning to login screen.
- Incorrect Update button size in app update available notification banner.
- Login not working with windscribe-cli.
- Emergency connect icon opacity.
- Incorrect network connectivity drop when restarting split tunnel extension on macOS.
- Decoy traffic not started when using pinned IP.
- Decoy traffic volume silently reverts to 'Low' after app restart.
- Input sanitation when using custom config.
- Potentially incorrect firewall rules when using custom configs.
- Combobox items in preferences are not left-aligned.
- Incorrect window ordering when returning to login screen.
- Incorrect window elements if showing credentials prompt immediately after CPU usage warning.
- Split tunnel applications not populated on some Linux distros.
- DNS not being set on the system for OpenVPN custom configs on Linux.

Added
- Feature to clear Wi-Fi history. Details here.
- Port selection on protocol change screen.
- Support for hashed login. Details here.
Improved
- Logging & detection for abusers.
- App robustness if the wstunnel process is killed or crashes on macOS.
- Automatic DNS manager detection on Linux.
- Edit box UX.
- CLI commands to return success when it is already in the correct state.
- WireGuard client IP determination and reduced dependency on server API.
- Tray menu UX for 'Show/Hide', replacing it with just 'Show app' on macOS and Linux.
- Helper command robustness and removed unused commands.
- Windows helper code organization and interaction with the Service Control Manager.
- Locations resizing behaviour.
- Window resizing behaviour and performance.
- Font sizing and contrast.
- Linux install scripts not to disable firewalld.
Fixed
- Captcha compatibility issues for ScribeForce customers.
- WireGuard connection may not reconnect after Windows wakes from sleep mode.
- Description width on protocol screen.
- Connecting to a static IP location may fail on WireGuard.
- WireGuard connection failures when key limit is reached.
- Multiple dropdowns showing at the same time on protocol screen.
- "Unsaved changes" alert may bypass invalid DNS settings check.
- Maximum log file size was too large. Now limited to 2 MB.
- Potential app crash on launch.
- App not displaying DNS conflict warning when a local DNS daemon is running and the custom DNS feature is enabled on macOS.
- Installer binary displaying incorrect version number and copyright date on macOS.
- Inclusive split tunneling route may not be added correctly on Linux.
- Helper resource leak on macOS and Linux.
- Editbox text may be cut off.
- Back button from captcha screen.
- IP rotate may be disabled unintentionally due to network changes.
- Invalid interfaces in MAC spoofing interface dropdown on Linux.
- Potential crash in logging.
- Helper commands sometimes get stuck on macOS 26.
- Package dependencies for arm64 architectures on Linux.
- Split tunnel toggles may be drawn at incorrect position.
- Tray icon sometimes can't be clicked on Linux.
- Text alignment in preferences.
- Scrollbar artifacts on curved border.
- Visual artifact when switching to ROBERT preferences.
- Context menu look on the custom config credentials prompt.
- Freshly launched app may not clean up stale interface on macOS and Linux.
- In-app data counter may be incorrect on macOS and Linux.
- Linux script not retaining SELinux context.
Updated
- ctrld to 1.4.9.
- OpenVPN to 2.6.17.
- curl to the official 8.17.0 release.
- OpenSSL to 3.6.0, and deprecated use of oqsprovider for post-quantum algorithms.

Added
- Individual toggle switches for split tunneling entries.
- Slovak translations from GitHub user kubalav.
- Greek (machine) translations.
- Prompt to use protocol as preferred after successful protocol failover.
- A backup endpoint for connectivity (tunnel) test in wsnet.
Improved
- Connected DNS UX.
- Sorting of countries by latency.
- Protocol selection after failover.
- Manual connection mode to try alternate datacenter server, if available, when first connection attempt fails.
- Docked tray behaviour on Windows.
- UX when split tunneling is enabled but the macOS system extension has not been approved.
- German translations provided by GitHub user Evonos.
- Logging for account abuse.
Fixed
- OpenVPN protocols not working on openSUSE Tumbleweed.
- Linux share proxy sometimes not working, particularly on CLI after reboot.
- IPv4/v6 DNS priority while connected on Linux.
- ctrld may not be terminated after disconnecting when using custom DNS preference.
- Protocol failover may cause IP pinning to fail.
- 'Firewall' label may be too long with some languages.
- One-time override not showing preferred protocol prompt.
- Background scaling issues on high DPI displays.
- Initial unhover opacity for IP utilities menu.
- Dropdown item order for sound notifications.
- Scrollbar was cutting off hover effect from location row.
- Window may extend beyond bottom of screen.
- A potential crash when clicking the login button multiple times.
- ws-no-pings advanced parameter is not respected.
- Rotating IP repeatedly and quickly may hit a rate limit.
- GUI misalignment and font when proxy gateway/secure hotspot are enabled.
- The login username input box losing focus when using the trackpad on macOS.
- Preferred protocol prompt should not be shown on IP rotate.
- A height calculation error for error descriptions.
- Installer background does not show on macOS 26.2 Beta.
- Tooltips not working at app launch until user clicks the main window on Linux.
- Qt log spam on Windows and Linux.
Updated
- OpenVPN to 2.6.16.
- 7zr utility to 25.01 on Windows.

Added
- IP rotation & favourite functionality.
- Control D option to Connected DNS.
- Preference for specifying the tray icon color on Windows.
- Optional port selection when connecting with windscribe-cli.
- WireGuard post-quantum encryption notice to the readme.
Improved
- Locations UI design to match the main screen.
- Korean translations from GitHub user Alex4386.
- Detection when circumvent censorship should be enabled automatically.
- Tooltip usability.
- Implementation of ICMP pings in wsnet for macOS.
Fixed
- OpenSSL auto-loading openssl.cnf security vulnerability.
- Potential privilege escalation on Linux.
- Automatic connection mode does not try alternate datacenter server, if available, when first connection attempt fails.
- VPN interface network category is private on Windows. Reverted to default value of public.
- Tray Icon Colour preference location by moving it to the Look & Feel tab.
- GUI showing the wrong field for Connected DNS in some cases.
- GUI window not hidden correctly when transitioning.
- Error message not hidden after successful fetching of Control D devices after a failed attempt.
- wsnet may stop processing DNS queries.
- Internet connectivity detection in some cases.
- AirDrop not working when using split tunneling on macOS.
- A potential application crash when quitting on macOS.
- Behaviour when menu bar icon is hidden via System Settings and app is docked on macOS.
- OpenVPN daemon fails to start when using an HTTP LAN proxy on Windows.
- OpenVPN protocols not connecting due to script permission on macOS.
- WireGuard handshake may timeout unexpectedly on Linux.
- Missing Linux dependency for desktop-file-utils.
- High CPU usage in helper on Linux.
- Erroneous assert in the debug log during GUI preferences output on macOS.
- Unnecessary usage of environment variables for testing.
Removed
- Refresh button for locations.
- Advanced parameter for configuring the VPN adapter network category as public on Windows.
- Deprecated (as of Windows 11 25H2) use of wmic utility.
Updated
- ctrld to 1.4.7.

Added
- Post-quantum server API integration.
- Advanced parameters for overriding the API, assets, and checkip domains used in wsnet.
Improved
- Icons on the favourites tab to be the country flag.
- Advanced parameter handling.
- wsnet to use bearer token in all server API calls.
- Audio library to reduce binary size.
- Locations list in CLI to show more information.
- Native window colours in accordance with OS theme.
- Filesystem organization/packaging per FHS on Linux.
- Highlight colours used in log viewer.
- Locations UI tweaks (highlight location under mouse, changed location icon).
- Text in macOS installer DMG is a bit blurry.
- Qt library dependency now served from vcpkg.
Fixed
- Clean app install and in-app updates may not work due to missing platform identifier on Linux.
- An issue where the account status bottom-bar widget was sometimes not displayed.
- Memory usage for flags. You should see a dramatic drop in app memory usage when it is launched.
- On certain screen scales the "Get more data" button is too large and overlaps the data counter.
- Unexpected scroll in the preferences screen when sending a debug log.
- Incorrect scroll position in preferences.
- Custom DNS preferences behaviour when user attempts to set Upstream 2 without first setting Upstream 1.
- Playing a sound may capture the audio device, preventing Windows from sleeping.
- Regression in the in-app updater on macOS for versions 2.17.2-2.17.4.
- Resize bar may be cut off when update banner is shown.
- Incorrect URL for the 'connection mode' help link in preferences.
- libcurl loading openssl.cnf from untrusted path.
- Potential crash when operating with empty port map.
- Some wsnet failover behaviour.
- Installer alert border on Windows and macOS.
- Missing tray icon on macOS.
- Missing xcb plugin on Linux.
- Missing window decorators for advanced parameter/log viewer screens in Wayland.
- Missing dependency for openSUSE.
- Rendering issues on X11 (non-wayland) environments.
- Last opened locations tab is not remembered.
- Alert window cut off when showing an update error.
- App no longer debug logging to the system debugger/stdout.
- Erroneous 'failed to set network category' error message from Windows helper.
- DNS may leak on Linux distros using resolvectl to determine the system DNS.
- wsnet not triggering failover on some invalid payloads.
- French translation of 'Release' update channel.
- Pings may be invalidated while connected.
- A crash in the audio dependencies when building on Windows.
- Rendering issues on X11 (non-wayland) environments.
- Potential DNS leak when using ctrld (custom DNS setting) on Linux.
Updated
- OpenVPN DCO driver to v1.3.3.
- ctrld to 1.4.6.

Added
- Post-quantum server API integration.
- Advanced parameters for overriding the API, assets, and checkip domains used in wsnet.
Improved
- Icons on the favourites tab to be the country flag.
- Advanced parameter handling.
- wsnet to use bearer token in all server API calls.
- Audio library to reduce binary size.
- Locations list in CLI to show more information.
- Native window colours in accordance with OS theme.
- Filesystem organization/packaging per FHS on Linux.
- Highlight colours used in log viewer.
- Locations UI tweaks (highlight location under mouse, changed location icon).
- Text in macOS installer DMG is a bit blurry.
- Qt library dependency now served from vcpkg.
Fixed
- An issue where the account status bottom-bar widget was sometimes not displayed.
- Memory usage for flags. You should see a dramatic drop in app memory usage when it is launched.
- On certain screen scales the "Get more data" button is too large and overlaps the data counter.
- Unexpected scroll in the preferences screen when sending a debug log.
- Incorrect scroll position in preferences.
- Custom DNS preferences behaviour when user attempts to set Upstream 2 without first setting Upstream 1.
- Playing a sound may capture the audio device, preventing Windows from sleeping.
- Regression in the in-app updater on macOS for versions 2.17.2-2.17.4.
- Resize bar may be cut off when update banner is shown.
- Incorrect URL for the 'connection mode' help link in preferences.
- libcurl loading openssl.cnf from untrusted path.
- Potential crash when operating with empty port map.
- Some wsnet failover behaviour.
- Installer alert border on Windows and macOS.
- Missing tray icon on macOS.
- Missing xcb plugin on Linux.
- Missing window decorators for advanced parameter/log viewer screens in Wayland.
- Missing dependency for openSUSE.
- Rendering issues on X11 (non-wayland) environments.
- Last opened locations tab is not remembered.
- Alert window cut off when showing an update error.
- App no longer debug logging to the system debugger/stdout.
- Erroneous 'failed to set network category' error message from Windows helper.
- DNS may leak on Linux distros using resolvectl to determine the system DNS.
- wsnet not triggering failover on some invalid payloads.
- French translation of 'Release' update channel.
- Pings may be invalidated while connected.
- A crash in the audio dependencies when building on Windows.
- Rendering issues on X11 (non-wayland) environments.
- Potential DNS leak when using ctrld (custom DNS setting) on Linux.
Updated
- OpenVPN DCO driver to v1.3.3.
- ctrld to 1.4.6.

Added
- New app UI design.
- Bundled backgrounds and sound notifications.
- Look & Feel tab in preferences.
- Two stage login and CAPTCHA.
- A new firewall mode Always On+.
- Advanced parameter for configuring the VPN adapter network category as public on Windows (ws-use-public-network-category).
- Advanced parameter to suppress pings (ws-no-pings).
- Flag resources for new locations.
Improved
- Installer icon on Windows and macOS.
- Preferences import/export to include advanced parameters.
- Inconsistent (English) spelling.
- App logs to output GUI and engine settings in JSON format.
- Chinese translation from GitHub user YerongAI.
- Russian translation.
- Build instructions.
- WireGuard® support on adverse networks by forcing a handshake after interface configuration.
Fixed
- Best Location is chosen incorrectly.
- CLI-only client waits forever to connect without internet connectivity.
- CLI-only client may not display a useful error.
- Some blocking CLI commands may consume more CPU than intended.
- Existing local DNS ignored when using custom DNS on Windows.
- Reconnection after waking from sleep may fail if split tunneling on macOS.
- Split tunnel rule precedence after waking from sleep on Linux.
- Internet connectivity detection when using PPPoE on Windows.
- Linux app aborting due to exception in boost library.
- 400 'header or cookie too large' for Cloudflare API endpoints.
- App firewall blocking Sidecar/Continuity features on macOS.
- Docked window is sometimes in the wrong position on macOS.
- Misleading log error message on Windows.
- wsnet sometimes not detecting OS default DNS server when using DHCP during app start on macOS.
- Build-a-plan shows as free account.
- Upgrade banner may show on a Pro account.
- OpenVPN config file path missing terminating double-quote in helper.
- In-app update download may fail prematurely on slow networks.
- Maximum CAPTCHA trail size too large and causing login failures.
Updated
- c-ares to 1.34.5.
- ctrld to 1.4.4.
- wireguard-go to 0.0.20250515 on macOS and Linux.

Added
- New app UI design.
- Bundled backgrounds and sound notifications.
- Look & Feel tab in preferences.
- Two stage login and CAPTCHA.
- A new firewall mode Always On+.
- Advanced parameter for configuring the VPN adapter network category as public on Windows (ws-use-public-network-category).
- Advanced parameter to suppress pings (ws-no-pings).
- Flag resources for new locations.
Improved
- Installer icon on Windows and macOS.
- Preferences import/export to include advanced parameters.
- Inconsistent (English) spelling.
- App logs to output GUI and engine settings in JSON format.
- Chinese translation from GitHub user YerongAI.
- Russian translation.
- Build instructions.
- WireGuard® support on adverse networks by forcing a handshake after interface configuration.
Fixed
- Best Location is chosen incorrectly.
- CLI-only client waits forever to connect without internet connectivity.
- CLI-only client may not display a useful error.
- Some blocking CLI commands may consume more CPU than intended.
- Existing local DNS ignored when using custom DNS on Windows.
- Reconnection after waking from sleep may fail if split tunneling on macOS.
- Split tunnel rule precedence after waking from sleep on Linux.
- Internet connectivity detection when using PPPoE on Windows.
- Linux app aborting due to exception in boost library.
- 400 'header or cookie too large' for Cloudflare API endpoints.
- App firewall blocking Sidecar/Continuity features on macOS.
- Docked window is sometimes in the wrong position on macOS.
- Misleading log error message on Windows.
- wsnet sometimes not detecting OS default DNS server when using DHCP during app start on macOS.
Updated
- c-ares to 1.34.5.
- ctrld to 1.4.4.
- wireguard-go to 0.0.20250515 on macOS and Linux.

Added
- Ability to customize location names.
- Support for local DNS as connected DNS.
- Fedora arm64 build.
Improved
- Client log when unable to retrieve WireGuard config from server.
- Anti-censorship mechanisms.
- IPC communication between the client and helper/service.
- Consistency of install package naming.
- Confusing "No P2P" icon.
- Flag assets.
- UX when unable to connect to the Windscribe helper/service.
- Behavior when the firewall is on and the app exits unexpectedly.
- UX and fixed text overlaps on the static IPs screen.
- Installer language detection to use app language if available on Windows and macOS.
- UX when user connects with split tunneling enabled, but has not approved the macOS network extension.
- Startup time when not docked on macOS.
Fixed
- The app freezing on exit.
- Cursor may not change when a location becomes disabled/enabled.
- Static IP link color may be incorrect.
- Static IP locations that are unavailable are not displayed.
- Window height is cut off if window transitions while being dragged.
- Firewall blocking VPN connections on port 53 on macOS.
- Potential crash at exit on macOS.
- Firewall may be briefly incorrectly disabled after in-app update on Windows and macOS.
- Tool-tip sometimes shows behind main window on macOS.
- Firewall behavior due to Linux iptables 1.8.11 bug.
- Postquantum KEMs not being proposed on Linux.
- Fixed Best Location is chosen incorrectly.
- Fixed exclusive-mode split tunneling fails to exclude host names on Windows.
- Fixed Windows installer buttons are not transparent.
- Fixed specifying a custom MTU value may cause the app to crash on Windows.
- Fixed docked window is sometimes in the wrong position on macOS.
- Fixed ctrld sometimes does not start when using custom DNS on macOS.
- Fixed enabling MAC spoofing causes loss of connection with the helper daemon on Linux.
- Incorrect comparison when importing location renames.
- Custom config name is cut too short.
- Latency bars display 'full strength' when ping information is not available/failed for the location.
- Unhandled -os_restart command-line argument from previous releases on Windows.
- Erroneous 'missing log' warning in merged logs due to Linux not having an installer log.
- Translations for Arabic/Farsi in Decoy Traffic.
Updated
- OpenVPN to 2.6.13.
- Qt to 6.8.3.
- ctrld to 1.4.3.
- liboqs to 0.12.0 and oqs-provider to 0.7.0.
Removed
- Code usage of Qt5 compatibility module.
- -no-drivers argument for Windows installer.
Known Issues
- Split tunneling on macOS 12/13

Added
- Per-app split tunneling on macOS.
- Decoy traffic feature.
- Showing device name when requesting list of static IP locations in CLI on Linux.
- --cacheonly to the update script for Fedora RPMs.
- Extended cleanup logs in wsnet.
Improved
- Decoy Traffic algorithm data rate limits on high-bandwidth networks.
- Changed VPN interface network category from public to private on Windows.
- Windows uninstaller folder security.
- Multi-desktop app window behavior on macOS.
- Windows-on-Arm installer to use arm64 7-zip extractor.
- Detection and logging of failures in the client<->helper communication mechanism on Windows.
- Flow when user enables Show notifications but system notifications are disabled on Windows.
- Custom connected DNS error UX.
- Initialization and preferences animations.
- Log frequency in wsnet.
- Reliability of wsnet in unstable network environments.
- Ping logging.
Fixed
- Always-on firewall not functional after reboot on Linux.
- App does not retry login if first attempt failed due to lack of connectivity.
- Allow LAN traffic takes precedence over split tunneling rule.
- Fixed split tunnel apps added via the search method may not be split tunneled on macOS.
- reset date being shown on account screen instead of expiry date for some plans.
- 2FA code expires before working endpoint can be found [wsnet].
- System notifications are disabled alert shown unexpectedly on Windows.
- App update fails when using pre-2.4 app on Windows.
- Installer alerts may not fit in window for some translations.
- Incorrect network status detection on macOS.
- Missing firewall rule to allow the VPN DNS when using IKEv2 on macOS.
- Disconnecting due to out of data turns off firewall.
- Incorrect check for LAN address for custom DNS.
- App stuck during login after accepting prompt to ignore SSL errors.
- Install fails if uninstall registry information is missing on Windows.
- Incorrect characters displayed in Windows installer bootstrap error message.
- Sometimes IP does not change after connecting with inclusive split tunnel on macOS.
- Some CLI commands may indicate that the operation was interrupted when it wasn't on Linux.
- Potential crash in ProcessManager [wsnet] on macOS.
- Mangled ar/fa translations.
- Docked window is sometimes in the wrong position on Windows.
- Inclusive split tunneling, IPv6 interactions, and split tunneling extension versioning on macOS.
- Inconsistent behavior when starting app and 'close to tray' is enabled.
- Window size after dismissing alert at the login window.
- Windows error message box may be displayed when reinstalling deleted/disabled Windscribe service.
- Split tunnel extension versioning on macOS.
- DNS no longer allowed by firewall if toggled while connected on macOS.
- Split tunnel rule in exclusive mode on Linux.
- Window size is incorrect after expanding then collapsing preferences on Linux.
- App is launched minimized instead of minimized to tray when Start Minimized and Close to Tray are enabled.
- Automatic-mode firewall remains on when Windows is restarted and the app is closed to the tray.
- App remains running, but non-functioning, if user cancels Windows shutdown.
- Split tunnel extension sometimes not started on macOS.
- Possible error when parsing the routing table on Linux.
- Location tab transitions to search tab even when modifier keys are pressed.
- Unnecessary delay when disconnecting on macOS.
- DNS not working on macOS 15.4 Beta 2.
- Toggling split tunneling mode while connected with WireGuard may cause loss of connection on macOS.
- CLI platform may be misdetected on Raspberry Pi.
- Missing dependency for the Fedora package.
Updated
- wstunnel dependency to v1.0.5. Adds support for anti-censorship TLS stuffing.
Removed
- IPv6 split tunneling (for now) due to edge cases.
- Some log spam on Windows and macOS.
Known Issues:
- Windows: the Circumvent Censorship feature does nothing when using the TCP protocol due to a missing feature in the OpenVPN DCO driver. If you re

Improved
- Decoy Traffic algorithm data rate limits on high-bandwidth networks.
Known Issues:
- Windows: the Circumvent Censorship feature does nothing when using the TCP protocol due to a missing feature in the OpenVPN DCO driver. If you require use of the TCP protocol and the Circumvent Censorship feature, you can add ws-use-openvpn-wintun to the Advanced Parameters setting to force the use of the wintun driver.

Added
- Per-app split tunneling on macOS.
- Decoy traffic feature.
- Showing device name when requesting list of static IP locations in CLI on Linux.
- --cacheonly to the update script for Fedora RPMs.
- Extended cleanup logs in wsnet.
Improved
- Changed VPN interface network category from private to public on Windows.
- Windows uninstaller folder security.
- Multi-desktop app window behavior on macOS.
- Windows-on-Arm installer to use arm64 7-zip extractor.
- Detection and logging of failures in the client<->helper communication mechanism on Windows.
- Flow when user enables Show notifications but system notifications are disabled on Windows.
- Custom connected DNS error UX.
- Initialization and preferences animations.
- Log frequency in wsnet.
- Reliability of wsnet in unstable network environments.
- Ping logging.
Fixed
- App does not retry login if first attempt failed due to lack of connectivity.
- Allow LAN traffic takes precedence over split tunneling rule.
- Fixed split tunnel apps added via the search method may not be split tunneled on macOS.
- reset date being shown on account screen instead of expiry date for some plans.
- 2FA code expires before working endpoint can be found [wsnet].
- System notifications are disabled alert shown unexpectedly on Windows.
- App update fails when using pre-2.4 app on Windows.
- Installer alerts may not fit in window for some translations.
- Incorrect network status detection on macOS.
- Missing firewall rule to allow the VPN DNS when using IKEv2 on macOS.
- Disconnecting due to out of data turns off firewall.
- Incorrect check for LAN address for custom DNS.
- App stuck during login after accepting prompt to ignore SSL errors.
- Install fails if uninstall registry information is missing on Windows.
- Incorrect characters displayed in Windows installer bootstrap error message.
- Sometimes IP does not change after connecting with inclusive split tunnel on macOS.
- Some CLI commands may indicate that the operation was interrupted when it wasn't on Linux.
- Potential crash in ProcessManager [wsnet] on macOS.
- Mangled ar/fa translations.
- Docked window is sometimes in the wrong position on Windows.
- Inclusive split tunneling, IPv6 interactions, and split tunneling extension versioning on macOS.
- Inconsistent behavior when starting app and 'close to tray' is enabled.
- Window size after dismissing alert at the login window.
- Windows error message box may be displayed when reinstalling deleted/disabled Windscribe service.
- Split tunnel extension versioning on macOS.
- DNS no longer allowed by firewall if toggled while connected on macOS.
- Split tunnel rule in exclusive mode on Linux.
- Window size is incorrect after expanding then collapsing preferences on Linux.
- App is launched minimized instead of minimized to tray when Start Minimized and Close to Tray are enabled.
- Automatic-mode firewall remains on when Windows is restarted and the app is closed to the tray.
- App remains running, but non-functioning, if user cancels Windows shutdown.
- Split tunnel extension sometimes not started on macOS.
- Possible error when parsing the routing table on Linux.
- Location tab transitions to search tab even when modifier keys are pressed.
- Unnecessary delay when disconnecting on macOS.
- DNS not working on macOS 15.4 Beta 2.
- Toggling split tunneling mode while connected with WireGuard may cause loss of connection on macOS.
- CLI platform may be misdetected on Raspberry Pi.
- Missing dependency for the Fedora package.
Updated
- wstunnel dependency to v1.0.5. Adds support for anti-censorship TLS stuffing.
Removed
- IPv6 split tunneling (for now) due to edge cases.
- Some log spam on Windows and macOS.
Known Issues:
- Windows: the Circumvent Censorship feature does nothing when using the TCP protocol due to a missing feature in the OpenVPN DCO driver. If you require use of the TCP protocol and the Circumvent Censorship feature, you can add ws-use-openvpn-wintun to the Advanced Parameters 

Added
- IPv6 support for split tunneling.
- Static IP support in CLI.
- Toggle to enable proxy gateway only while VPN is connected, based on contributions from GitHub user intangir.
- h3:// and sdns:// protocol support for ctrld (custom DNS preference).
- A changelog link in the About preferences screen.
- Translation keys for 'Release' and 'Beta' release channels.
Improved
- Location ordering when searching.
- Network detection and minimized location service requests on Windows 11 24H2.
- UX for some CLI commands.
- CLI entry of credentials when logging in.
- Japanese translations from GitHub user Ue05.
- Russian translations from GitHub user MedicalJewel105.
- Login/logout CLI flow.
- UX and performance when dragging windows to different screens.
- Installer to notify the user if the helper service fails to install on Windows.
- Error reporting if installation to a custom folder fails on Windows.
- Split tunneling apps list population on Linux, based on contributions from GitHub user intangir.
Fixed
- Potential local privilege escalation vulnerability in the Windows installer bootstrap.
- Autoconnect attempting to connect to invalid locations.
- Incorrect static device name.
- Scroll position not retained when leaving/reentering a window.
- Importing JSON may put the Secure Hotspot preference in an invalid state.
- Changelog link for many platforms was incorrect in General Preferences.
- Incorrect connectivity detection on macOS 15.x+ when rebooting the OS with the firewall set to always on.
- A potential program quit hang [wsnet].
- Custom config path not checked when importing preferences.
- Symlink target for windscribe-cli.
- Additional 'Start Minimized' use cases.
- Static IP commands in CLI with GUI backend.
- CLI symlink sometimes not created on macOS.
- Start Minimized may not work when "Minimize windows into application icon" is enabled on macOS.
- Incorrect firewall rule blocking IPv6 during inclusive split tunnel on Windows.
- Missing interface in MAC spoofing dropdown.
- Window is invisible when app is docked in Windows and device pixel ratio is not 1.
- Missing 'psmisc' dependency on Linux.
- Incorrect usage of nmcli in the Linux CLI client.
- Incorrect log names for Linux CLI client.
- Invalid MAC spoofing loop when specifying an invalid address on Linux.
- The Ecuador flag.
- Missing null pointer checks in the client application.
Removed
- Ability to use Secure Hotspot together with inclusive split tunneling.
- IPv6 toggle in preferences.
Updated
- ctrld, utilized by the custom DNS preference, to 1.3.10.
Known Issues:
- Windows: the Circumvent Censorship feature does nothing when using the TCP protocol due to a missing feature in the OpenVPN DCO driver. If you require use of the the TCP protocol and the Circumvent Censorship feature, you can add ws-use-openvpn-wintun to the Advanced Parameters setting to force the use of the wintun driver.

Added
- MAC spoofing in Linux.
- Support for in-app updates from many immutable Linux distros.
- Flags for new and upcoming locations.
- Link to our website for further information about the Circumvent Censorship feature in preferences.
- Additional curl logs for failed server API requests in wsnet.
Improved
- UDP/TCP/Stealth/WStunnel protocol performance on Windows by using the OpenVPN DCO kernel driver as their default driver.
- Behavior when querying the SSID on Windows 11 24H2 and Location services is off.
- Behavior when querying the SSID on macOS 15.
- Description for packet size, clarifying that it doesn't do anything for TCP-based protocols.
- Error message when update download fails.
- The failover algorithm in wsnet to prevent it from 'sticking' to one domain.
- Split tunneling behavior on Linux by doing a self-test at service start.
Fixed
- Docked Windows app does not detect change in taskbar size and adjust position when displayed.
- App update may fail to stop and remove OpenVPN/Wireguard daemons on Windows.
- Debug log may fail to send.
- Double blinking cursors on custom config credentials prompt.
- Custom config authorization data not deleted when custom config directory cleared.
- Latency endpoint duplicate requests.
- Imported JSON values may be incorrect.
- Additional JSON & GUI input validation errors.
- Proxy validation to only allow an IP address. Prior proxy configurations using a hostname will no longer function.
- Proxy gateway sometimes sends invalid headers.
- Memory leaks in wsnet.
- UDP protocol on Windows may fail to connect when Circumvent Censorship is enabled.
- "Secure Hotspot" feature not being disabled properly when using IKEv2 on Windows.
- Installer ignoring username/password command-line arguments on Windows.
- Emergency connect fails to connect due to incompatibility with OpenVPN DCO driver on Windows.
- macOS installer may mangle the 'windscribe' user if it's a regular user.
- Always-on firewall may not be enabled after reboot on macOS.
- Installer window in wrong position during in-app update on macOS.
- Unexpected permission prompt during upgrade on macOS.
- Custom DNS may be bound to wrong interface due to firewall state cache on macOS.
- Potential app crash on macOS when App Internal DNS setting is 'OS Default'.
- Potential app crash when installing helper on macOS.
- Memory leaks in IPC and other macOS-specific code.
- Linux helper may get stuck when disconnecting on Raspberry Pi with split tunneling enabled.
- openSUSE CLI install script not starting the helper service.
- Auto-rotate MAC not working when disconnecting and reconnecting to the same network on Linux.
- Linux helper service may not be restarted after update.
- Debian package dependencies for Debian Trixie.
- Possible delay when setting firewall rules on Linux.
- Update not working in Fedora Silverblue while connected.
Updated
- Windows OpenVPN DCO driver to v1.2.1.
- German translations provided by GitHub user Evonos.
- Spanish translations provided by GitHub user IceString3.
- Russian translations in installer.
- c-ares in wsnet to the latest version 1.33.1, increased timeouts for DNS requests.
Known Issues:
- Windows: the Circumvent Censorship feature does nothing when using the TCP protocol due to a missing feature in the OpenVPN DCO driver. If you require use of the the TCP protocol and the Circumvent Censorship feature, you can add ws-use-openvpn-wintun to the Advanced Parameters setting to force the use of the wintun driver.

See changelog for details on what is new and fixed.Installer Hashes
| Installer | SHA-256 hash |
| --- | --- |
| Windows x86_64 | d2a817e8f2738cacc646d3dc2194d7fd28f2ce1de435be24fa98ed8928b4daa2 |
| Windows arm64 | 2c70b96e559474ad8518d5cc53ff92a6cf8277a530245760f42b0a3bbc50cea7 |
| macOS universal | 683093d718680f1cb8b5fe0c4ec14fd1fdad357c9a9a46438feeb19331ffb185 |
| Ubuntu x86_64 | c1c62d4101b63dd574b986a124b07c5e9649f88e7a249dc42a454b4f90105baa |
| Ubuntu arm64 | 83fdc19f54b1b5fa907e5b3a9ab6b4e8fe92f0e3deac11af4df67bd0a697280f |
| Fedora x86_64 | cb254b2fe0246a5f5ee23a51dee05a77fc2a7872ec7afc9403d65da52bf13ab1 |
| Arch Linux x86_64 | 915f6cba01cb801e8c91dda3a2d0d4cc4da76833d73c7a1112569ee8f5112bc3 |