We never list markets. Check the first and last six characters of every address before you sign in.

The Hidden Wiki

Tor News

Tor’s September 2026 Security Fixes – What to Update

By admin 13 min read
On this page
  1. A fix is a chain, not a moment
  2. What was fixed in September
  3. Find your row
    1. Tor Browser on a computer
    2. Tor Browser on Android
    3. Tails
    4. Relay, bridge and onion service operators
    5. Orbot and Onion Browser
    6. Tor VPN beta
  4. How to check you’ve really got the fix
    1. Tor Browser
    2. Tails
    3. Tor on Linux, relays and onion services
    4. Orbot and other apps
  5. The gap between “fixed” and “fixed for you”
    1. Why the gaps exist
    2. What to do while you wait
  6. What these fixes don’t change
  7. What to watch next
  8. Where to go next
  9. Sources

A fix is a chain, not a moment#

On September 23, 2026, the Tor Project released Tor 0.4.9.13, its second emergency security update in fifteen days. Most of the coverage stopped there, with a headline and the advice to “update now”. That advice is correct, but it leaves out the part that actually decides whether you’re protected.

Very few people use Tor 0.4.9.13 directly. Instead, they use a program that includes it. Tor Browser comes with its own copy, Tails includes Tor Browser and another copy, Linux distributions package it, and mobile apps build it into their own software. Each of these has to pick up the update, test it and release it, and each does so on its own timetable. So a security update doesn’t appear everywhere at once. It moves along a chain, and you’re only protected when it reaches your link.

September 2026 showed this very clearly. Tor Browser 15.0.23 was released on September 15, a week before 0.4.9.13, and so missed the fixes. Tor Browser users had to wait for 15.0.24 on September 29, and Tails users got the updates a day later, on September 30. Relay operators who install Tor from the Tor Project’s own packages could update the same day. Some mobile apps, at the time of writing, may still be catching up.

This article isn’t another collection of bug numbers. It’s a guide to finding the update that applies to you. We’ll look briefly at what was fixed and who it affects, then at what each type of Tor user should update, how to check you actually have the fix, and what to do if the app you depend on hasn’t included it yet.

What was fixed in September#

Two versions of the core Tor software were released that month, and both matter.

Tor 0.4.9.12, September 8. The Tor Project’s announcement, forwarded to the oss-security mailing list, said it fixed a number of high-severity security problems and added a few minor features. It also said the next release, 0.4.9.13, was due around September 22, while warning that the recent surge of security issues could force the team to act quickly.

Tor 0.4.9.13, September 23. It arrived on time, with fixes for relays, clients and onion services. According to reporting on the release notes, they list sixteen categories of fixes, ten of them with TROVE numbers, Tor’s own identifiers for security problems. The project also said it expected to issue security updates every two or three weeks over the coming months.

Full technical details were due about a week after the release, which gives people a chance to update before the bugs can be studied closely. That’s another good reason not to delay. Here are the ten TROVE entries in 0.4.9.13, grouped by who they matter to most.

TROVE What it fixes, in plain terms Matters most to
2026-056 Memory that’s used after being freed when a TLS connection fails to set up Everyone, especially relays, which accept many connections
2026-051 Possible memory corruption and crashes in certain setups that map DNS lookups to virtual addresses People running Tor as a system-wide proxy
2026-053 How onion service circuits keep different activities separate Onion service operators and visitors
2026-058 A problem with rendezvous circuits, where visitors and onion services meet Onion service operators and visitors
2026-012 Introduction points not rotating when their anti-replay memory fills up Onion service operators
2026-050 Reverse DNS answers being kept when caching is switched off Clients and exit relays
2026-052 Directory connections being reattached when they shouldn’t be Clients and relays
2026-030, 038, 041 Guard relays being wrongly blamed for failures they didn’t cause Clients, which pick guards, and the relays themselves

Two things stand out. First, onion services get three separate fixes, so this update matters not only to relay operators but to anyone who runs or visits onion sites. If you’d like a quick reminder of how introduction points and rendezvous circuits work together, see What Is an Onion Service? Second, the guard fixes are more about fairness and stability than about direct attacks. Clients that wrongly blame a good guard can end up switching guards more often than they should, and steady guards are an important part of what protects you.

What the release notes don’t say matters too. They don’t credit individual researchers, and at the time of release, they didn’t explain how any bug could be exploited. So be cautious about any claim of what an attacker could do until the Tor Project publishes its own details.

Find your row#

This is the part that matters. Find the line that describes how you use Tor, and make sure you’re on the version in the middle column or a later one.

How you use Tor The version that has the September fixes How it reaches you
Tor Browser on Windows, macOS or Linux Tor Browser 15.0.24, released September 29 Automatic update, or download.torproject.org
Tor Browser for Android Tor Browser 15.0.24 Google Play, or the APK from the Tor Project
Tails Tails 7.14, released September 30 Automatic upgrade from Tails 7.0 or later
Tor installed on Linux from the Tor Project’s packages tor 0.4.9.13 The deb.torproject.org repository, the same day
Tor from your Linux distribution’s own repository tor 0.4.9.13, or your distribution’s patched build Whenever your distribution ships it
Relay or bridge operator tor 0.4.9.13 Your package manager or Docker image, then a restart
Onion service operator tor 0.4.9.13 Your package manager or Docker image, then a restart
Orbot or Onion Browser Whatever build includes tor 0.4.9.13 The app store, once the developers ship it
Tor VPN (beta) The latest version in the store Google Play or F-Droid. It’s built on different code, explained below

Tor Browser on a computer#

Since Tor Browser updates itself by default, you most likely already have 15.0.24. It contains tor 0.4.9.13, Firefox 140.17.0esr with security fixes backported from Firefox 157, and an updated NoScript, as listed in the release notes. Mozilla publishes the Firefox side of those fixes in its security advisories. If the browser has been running for several days, restart it, because updates only take effect on restart.

People installing Tor Browser on Windows from scratch should know about one issue. The Tor Project’s Windows code-signing certificate expired on September 1, and its renewal was delayed. So for a fresh install on Windows, the download page still offers 15.0.20, the last correctly signed version, and relies on automatic updates, which use a different key, to bring you up to date. Install it, connect once, let it update, and then restart. We explain this in full in our Tor Browser 15.0.24 release notes.

If you use 32-bit Linux, the 15.0 series is the last one that supports you, so it’s time to plan a move to a 64-bit system.

Tor Browser on Android#

If you installed the app through Google Play, update it there. Otherwise, download the new APK from the Tor Project. The Android version of 15.0.24 uses the same Firefox 140.17.0esr engine and the same tor 0.4.9.13 as the desktop version. If you’re unsure which Android app you have, our guide to Using Tor on Android and iPhone shows the genuine ones.

Tails#

Tails 7.13 carried the first set of fixes, with tor 0.4.9.12. Tails 7.14 carries the second, with Tor Browser 15.0.24, tor 0.4.9.13 and a newer Linux kernel. If you’re on Tails 7.0 or later, the automatic upgrade keeps your Persistent Storage. For the other changes, see Tails 7.14.

Relay, bridge and onion service operators#

This release matters most to you, because relays and onion services handle connections from strangers all day. Upgrade to 0.4.9.13 now, then restart the tor service. Installing a new package doesn’t stop the old version running until the process restarts. If you run Tor in Docker, pull the 0.4.9.13 image and recreate the container. If you run onion services, the three onion fixes apply to you directly.

Orbot and Onion Browser#

The Guardian Project’s apps build Tor into themselves, so they only get the September fixes when their developers release a new version. At the time of writing, we couldn’t confirm a public Orbot release built on 0.4.9.13. Check the version shown in the app, and update as soon as a new one appears. For now, the safer choice for browsing on Android is Tor Browser for Android, which already has the fix.

Tor VPN beta#

The Tor Project’s Tor VPN app for Android is built on Arti, Tor’s newer implementation written in Rust, not on the C code that 0.4.9.13 fixes. So the September bugs don’t automatically carry over to it. Keep it updated anyway, because Arti has its own releases, most recently Arti 2.7.0 on October 1. For more, see our Tor VPN beta overview.

How to check you’ve really got the fix#

“I updated” and “I’m running the fixed version” don’t always mean the same thing. An update can download without being applied, a package can install while the old process keeps running, and an app can be up to date while still bundling an older Tor. Each of these checks takes a minute.

Tor Browser#

Open the menu, go to Help, then About Tor Browser. The window shows your version and checks for updates at the same time. You want 15.0.24 or later. On Android, the same information is under Settings, then About Tor Browser.

If you downloaded a new copy rather than updating, check its signature before installing it. Since this release, Tor Browser downloads are signed with a new subkey, so if you’ve verified downloads before, you may need to refresh the Tor Browser signing key in your keyring first. Our guide to installing Tor Browser safely walks through the whole process, and the Tor Project’s verification page explains how to refresh the key.

Tails#

Open the About Tails window from the Tails menu. You want 7.14 or later. If an automatic upgrade failed, the Tails website explains how to upgrade manually.

Tor on Linux, relays and onion services#

Check the installed version.

tor --version

You want 0.4.9.13 or later. Then make sure the running process is the new one, not an old copy that started before the upgrade. On systems that use systemd, this shows when the service last started, which should be after you installed the update.

systemctl status tor

If it started before the upgrade, restart it.

sudo systemctl restart tor

For Tor in Docker, run the version check inside the container, replacing the name with your own.

docker exec your-tor-container tor --version

Relay operators can also look up their relay on the Tor Project’s Relay Search. It shows the version each relay reports to the network, which is a good outside check that the restart really happened.

Orbot and other apps#

Apps that bundle Tor usually show the bundled Tor version on their About screen or in their release notes. Orbot’s release names include it, for example a version ending in “tor-0.4.9.13”. If the Tor version shown is older than 0.4.9.13, you don’t have the September fixes yet, however recently the app itself was updated.

The gap between “fixed” and “fixed for you”#

Here’s how September 2026 actually played out, link by link.

  • September 1. The Tor Project’s Windows code-signing certificate expires, making fresh Windows installs more awkward for the rest of the month.
  • September 8. Tor 0.4.9.12 is released, and Debian packages from the Tor Project are available the same day.
  • September 15. Tor Browser 15.0.23 is released.
  • September 23. Tor 0.4.9.13 is released. Tor Browser 15.0.23 doesn’t include it, because it shipped eight days earlier.
  • September 29. Tor Browser 15.0.24 comes out with tor 0.4.9.13.
  • September 30. Tails 7.14 is released with both.
  • October 1. Arti 2.7.0 is released, for apps built on Tor’s Rust code.

So a relay operator using the Tor Project’s packages could be protected on September 23. A Tor Browser user was protected six days later, a Tails user seven days later, and some mobile users were still waiting into October. That isn’t negligence. Each step involves building, testing and, for app stores, a review the developers can’t control. But it means “Tor has fixed it” and “you’re protected” can be weeks apart.

Why the gaps exist#

  • Tor Browser has to combine two projects. It bundles Tor with Firefox, and its releases follow Firefox’s security schedule. A Tor fix that lands between browser releases waits for the next one, unless the problem is serious enough to justify a special release.
  • Tails includes everything. It moved to a two-week release cycle with Tails 7.12, matched to Firefox’s releases, so it usually follows Tor Browser within a day or two.
  • Linux distributions test first. Stable distributions often backport fixes to an older version instead of shipping the new one, and do it on their own schedule. That’s why the Tor Project runs its own package repository.
  • Mobile apps wait for review. Apple and Google both review app updates, and smaller teams such as the Guardian Project’s ship when they can.

What to do while you wait#

If the product you depend on hasn’t released the fix yet, you have a few sensible options.

  1. Switch to a link that already has it. For browsing on Android, Tor Browser 15.0.24 already includes 0.4.9.13. On a computer, Tor Browser and Tails are both up to date.
  2. Get Tor from the source. On Debian and Ubuntu, the Tor Project’s own package repository gets security updates the same day, usually well ahead of a distribution’s own repository. Its packages are also available over onion, as we explain in Open-Source Projects on Onion, and the addresses are listed among the Tor Project’s onion sites.
  3. Don’t go looking for unofficial “patched” builds. The gap between a fix and an official app update is exactly when fake “updated” versions appear on download sites and in app stores. Wait for the real one. Our post on fake ‘dark web’ apps explains how to spot them.
  4. Turn up your browser’s security level for sensitive browsing. It won’t fix bugs in Tor itself, but it does reduce what a hostile website can do through the browser while you wait for other updates. See Tor Browser Security Levels.

What these fixes don’t change#

Two emergency releases in fifteen days is alarming, and some of the reporting made it sound even worse. It’s worth keeping a few things in proportion.

Nothing in the release notes says these bugs were used in attacks. The Tor Project described them as high-severity and advised people to update promptly, which is the right call. But high-severity means a bug could do real damage if exploited, not that anyone has exploited it. Until the technical details are out, nobody outside the project knows how practical any of them would be to use.

Finding and fixing bugs in public is how this is meant to work. Tor’s code is open, people examine it carefully, and when they find problems, fixes are issued and announced. A quiet project with no security releases isn’t safer. It’s just been looked at less.

The Windows signing problem is separate, and as of 15.0.24 it wasn’t resolved. It doesn’t affect people who already have Tor Browser and let it update. It does make fresh Windows installs more of a nuisance, and it’s the kind of situation scammers like, because “ignore the warning” is easy advice to abuse. Get the installer only from the Tor Project, and verify the PGP signature.

None of this changes how you should use Tor day to day. The habits that protect you most are the same as before. Keep automatic updates on, restart now and then so updates take effect, use the security level that fits what you’re doing, and get your addresses from their real sources, as described in How to Verify an Onion Address Is Official or through our Official Onion Mirrors Directory.

What to watch next#

  • More security releases. The Tor Project said to expect them every two or three weeks for some time. Each one will travel down the same chain, so the checks above will stay useful.
  • The technical details for 0.4.9.13. When they’re published, we’ll update this post with what each fix actually defends against.
  • Tor Browser 16. The next major version is in alpha testing, with 16.0a13 released on October 1. Alpha versions aren’t meant for everyday use, but the stable release will bring more changes than these maintenance updates.
  • The end of 32-bit Linux support. If that’s you, the 15.0 series is your last.
  • Orbot and Onion Browser updates. Watch for releases that include tor 0.4.9.13.

The easiest way to keep up is the Tor Project blog and the news section of the Tor Project forum. We also cover every release that matters for ordinary users in our Tor News section.

Where to go next#

Sources#

Leave a comment

Your email address will not be published. Required fields are marked *

Onion addresses posted here are checked against our directory automatically. Never trust an address from a comment until you have verified it.