‍ ‍‍‍ᓭ cryptostorm ᓯ

Regarding the PHP vulnerability from today (see php.net/archive/2026.php#202… ), our VPN servers aren't vulnerable since they don't have PHP installed, but our main website does use PHP for cryptostorm.is/blog/ and cryptostorm.is/paste/ so we updated to the fixed PHP 8.5.12

v4.05 Windows client: cryptostorm.is/windows#widge… OpenVPN updated to v2.7.8, OpenSSL to 4.0.3, stunnel to 5.82

v4.04 Windows client: cryptostorm.is/windows#widge… This updates the bundled OpenVPN to the v2.7.7 that was announced ~3 hours ago. The recent entries at the top of community.openvpn.net/Securi… have details on the security fixes included in this update.

v4.03 Windows client: cryptostorm.is/windows#widge… Fixes <=4.02 updater conflict. Affected: run cryptostorm_setup.exe from client root: Program Files (x86) [64-bit] / Program Files [32-bit]. Bundled: OpenVPN 2.7.6, OpenSSL 4.0.2, plink 0.85; stunnel/Xray unchanged (5.80/26.3.27).

v4.01 of our Windows client is at cryptostorm.is/windows#widge… See attached for client-side fixes. Servers were updated to OpenVPN 2.7.5 on the 2nd, and v4.01 bundles 2.7.5, so we're good on CVE-2026-12996, CVE-2026-13117, CVE-2026-12932, and CVE-2026-13698.

OpenVPN can finally do post-quantum key exchanges, which all of our instances support, if the client has a recent enough OpenSSL/OpenVPN. We also completely rewrote our Windows client and added Xray support and better/more translations. See cryptostorm.is/blog/pq-openv…

Regarding the github.com/V4bel/dirtyfrag vulnerability that was disclosed a few hours ago, our servers aren't vulnerable since we're not using the affected modules. Now go buy tokens - cryptostorm.is/#section5

Regarding the copy.fail/ vulnerability, our servers do run Arch Linux, but they're not vulnerable since support for the affected kernel crypto API (AF_ALG) isn't enabled, and the module is blacklisted as described on cryptostorm.is/blog/port-str…

We added public DNS-over-HTTPS endpoints with optional ad/tracker blocking See cryptostorm.is/blog/doh The post also includes setup instructions for popular browsers, age/ID verification law comments, lifetime token news, and a Windows client update.

Our current supply of minted lifetime tokens is down to 24, and when those are sold we will be removing the option to purchase new lifetime tokens cryptostorm.is/#section5 <- buy one now before they're all gone And no, they will not return for the annual Black Friday sale

We finally got around to updating our Linux kill switch page + scripts: cryptostorm.is/killswitch Replaced the old pile of legacy scripts with one clean, unified solution (WireGuard + OpenVPN, nftables + iptables).

We updated cryptostorm.is/xray/ to include xtls-rprx-vision support. The old configs should still work, but updgrading is recommended. Our CSXRAY Android app has also been updated - github.com/cryptostorm/CSXRA… and so has the server-side Xray instances (Xray-core v26.3.27)

We added better isolation to the backend endpoints for cryptostorm.is/wireguard and /wireguard_man but a (now fixed) bug was causing keys to not propagate the network correctly for the past 24 hours. If you used either page in that time, please go back and add/del your key again.

We wrote a blog post about our new server-side multihop feature. See cryptostorm.is/blog/ssmultih…

We added a new server-side multihop feature: connect like normal and go to http://10.31.33.7/multihop to use it. Also updated to OpenVPN 2.7.0 on all the servers, and re-enabled DCO on the UDP instances since 2.7.0 is using a newer (less buggy) DCO

Xray support is live and our custom Android app is finished, see cryptostorm.is/blog/xray

For those already asking: Yes, we will be doing the Black Friday to Cyber Monday half-off sale this year (Nov 28 - Dec 1), same as we've done every year for the past decade or so. Xray support is live and our custom Android app is finished, but the blog post is still in-progress

We extended the ports you can connect to our VPN entry IPs on (was 1-29999, now 1-65535). That was leftover from when the entry IP was the exit IP, but they're separate now so we can use all ports. Port forwarding is still restricted to ports >30000. cryptostorm.is/

We wrote a quick blog post better explaining the post-quantum stuff involving SSH that we tweeted about on July 3. Also added a couple of other things to the post (fixed an ad/tracker blocking issue, and info about the Xray setup we're working on). cryptostorm.is/blog/pq-opens…