Mix Networks Friday — September 11 2026 Weekly Update

Weekly companion to the Mix Networks 2026 Research and Deployment Tracker and Overview - Mix Networks. This week is shipping-week: Tor 0.4.9.12 (Sep 8) — the TROVE-2026-036/042 security release that bundles two DoS fixes (small VirtualAddrNetwork IPv4 DNS resolution; unbounded consensus diff sizes), a CGO negotiation fix so it works with every CGO-capable hop not just the final hop, and a defense-in-depth block on consensus-instructed congestion-control downgrade (ticket 41361). Tor Browser 15.0.22 (Sep 9) bundles 0.4.9.12 plus the new release cadence. Tor VPN Beta retrospective (Sep 9, by pavel) confirms Tor VPN is built on Arti, uses per-app circuit isolation, added WebTunnel bridges (1.4.0 beta), reproducible builds, and F-Droid availability — and explicitly notes congestion control is not yet available in Arti (carried over from C-tor). NymVPN v2026.12.4-beta.4 (Sep 10) ships three beta.2 → beta.4 in two days with 10 fixes plus the headline entry-handshake blacklist (#6308) and an Android rustls-platform-verifier panic fix; crates release 1.22.0 (Sep 7) plus Nym SDK feature gating (#7123) now lets downstream SDK builds strip subsystems they don't need (filesystem storage, SOCKS5, IPR, bandwidth, streams, TCP proxy, client pooling, CLI) — a major surface-area change for embedded and WASM clients. HOPR feat(session)! #8365 is a SURB protocol-version boundary (/hopr/mix/1.2.0): every SURB now carries a generation byte; on every return-path re-plan the SURB creator advances generation, and the replier clears the per-pseudonym SURB buffer for the old generation on first push — the explicit signalling complement to #8368's relayer-diversity diagnostics and #8374's StallGuardSink that prevents the OOMKilled-head-of-line-blocking class of bug that took jura-dev down Aug 27. Katzenpost ships a NoOp heartbeat to gateways on idle connections (#1133), kpclientd multi-socket + stale-socket repair (#1115, #1118), the Cbor plugin startup-diagnostics cluster (#1130 plus the convergence cluster Sep 6), and publishes a public letter to the European Parliament ahead of Thursday's Chat Control vote ("you are about to outlaw what you paid us to build"). I2P ships i2psnark hardening against haoxucu-reported DoS: unbounded bdecode recursion (StackOverflowError through catch(Exception) into dispatcher-thread death), i2ptunnel SOCKS 4/4a downgrade bypass of proxy auth, plus i2psnark path-traversal checks (3 commits, Sep 4–8). Tor network relay count at ~9,331 (Sep 8) — a steady ~9% drop from Sep 1's 10,137, consistent with the 0.4.8 EOL cut continuing to prune; the count is the lowest since the early-2024 LBTM pruning pass.

TL;DR — This Week

• Tor 0.4.9.12 (Sep 8) — TROVE-2026 security release. Two DoS fixes (TROVE-2026-036: small VirtualAddrNetwork IPv4 resolution; TROVE-2026-042: unbounded consensus diff sizes), CGO negotiation now works with every CGO-capable hop not just the final one, defense-in-depth block on consensus-instructed congestion-control algorithm downgrade (ticket 41361). SRV generation double-entry tie-breaker fix on directory authorities (bug 41356). Regenerated fallback directories Sep 8. GeoIP updated. Sep 8's 0.4.9.12 is the first 0.4.9.x point release after the 0.4.8 EOL (Sep 1) — and the one Tor Browser 15.0.22 (Sep 9) bundles.
• Tor Browser 15.0.22 (Sep 9, by ma1) — single line in changelog: "Updated Tor to 0.4.9.12". The 2-week cadence is now in steady-state: 15.0.21 (Sep 1) → 15.0.22 (Sep 9, 8 days). Plus Tor VPN Beta retrospective (Sep 9, by pavel) — first long-form writeup of how Tor VPN Beta works, what they've learned, and what's next.
• NymVPN v2026.12.4-beta.4 (Sep 10) — three beta releases in two days (beta.2 Sep 9, beta.3 Sep 10 14:54, beta.4 Sep 10 18:00). Headline: PR #6308 "Entry handshake check" — detects a failed entry-gateway WireGuard handshake earlier (via PR #6282 follow-up) and blacklists the entry gateway before the user wastes time on it, distinguishing from exit-gateway blame. Plus #6272 "Make pinned gateways respect the blacklist" (shipped), 8 platform/CLI bugfixes (macOS DNS restore, kill-switch re-apply guard, slow-exit-handshake headroom, zk-nym credential retry, gateway-refresh-storm fix, Windows VPN-service-install wait, daemon-command-loop blocking fix, Android reqwest/rustls-platform-verifier panic fix, Android always-on VPN blocking interface). Bumps embedded nym/vpn/release/2026.14-amsterdam to include LP registration clock-skew stamps (#7150).
• Nym main repo this week — 12 PRs merged Sep 4–10. crates release 1.22.0 (#7139, Sep 7) is the major-version bump; SDK feature gating (#7123, Sep 8) lets consumers opt out of subsystems (filesystem storage, SOCKS5, IPR, bandwidth, streams, TCP proxy, client pooling, CLI) — the foundation for lighter WASM/embedded builds. LP registration clock-skew (#7150, Sep 10) brings LP request timestamps into line with bandwidth-claim skew correction so devices more than 30 s fast are no longer wrongly rejected. Other items: BandwidthController prune command (#7085), hickory 0.26.2 vuln bump (#7137), nym-bridges cleanup (#7036), snapshot-retrieval best-effort (#7132), has_sufficient_tokens API cache docs (#7144), non-interactive auto-topup fix (#7143), lwd stream patch (#7098), stream keepalive (#7120), openspec archive stream liveness (#7141), nodes top-up program hotfix (#7142).
• HOPR #8365 feat(session)!: generation-tagged SURB consumption (Sep 9) — breaking protocol change at the /hopr/mix/1.2.0 boundary. Every SURB batch now carries a generation byte (RFC-1982 serial) in SurbReceiverInfo; the creator advances it on every return-path re-plan; the replying side keeps only the highest generation it has seen, and the first push carrying a newer generation clears the per-pseudonym SURB buffer wholesale. SURB wire size grows by 1 byte. Generation tagging is orthogonal to SurbPopOrder (FIFO default; LIFO still functional). Together with #8368 (relayer-diversity blind-spot diagnostics, which on Aug 28 took the gnosis VPN tunnel down invisibly) and #8374 (StallGuardSink against jura-dev OOMKilled-class egress head-of-line blocking from Aug 27), HOPR is doing protocol-level return-path robustness work in the same week that Arti/Tor ships the CGO negotiation fix — both are about "the return/forward path is alive" being a first-class concern.
• Katzenpost (Sep 4–8): #1133 NoOp gateway heartbeat — mirrors the gateway's NoOp heartbeat to us. The idle client's only traffic was a single GetConsensus2 per epoch, which could race the gateway's 2-minute read timeout mid-epoch; now the client mirrors the heartbeat back. #1132 / #1130 finish the Cbor plugin startup diagnostics thread (6+ commits Sep 4–8: stop double-logging startup failures, instrument seven silent drop sites, capture plugin stderr, fail fast with one clean exit path). #1115 + #1118 add multi-Unix-listener-socket support with stale-socket repair to kpclientd (POSIX; Windows unaffected). #1129 docker compose port isolation. #1127 fix race condition in TestUnmarshalTOML. #1121 give silent-holder failover test slow-CI budget. #1122 retry a transient replication failure during Copy. #1123 wait longer than worst-case round trip in sendAndWait. #1124 bound resend wait with optional context. #1125 pin latest hpqc for thinclient-diet changes. #1126 genconfig flags proxyWorkerCount + proxyRequestTimeout.
• I2P hardening week (Sep 4–10, all reported by haoxucu) — i2psnark: Catch unbounded bdecode recursion (Sep 4): BDecoder applied no recursion limit to untrusted bencode, so a large nested list/map produced StackOverflowError that passed through every catch(Exception) on the receive path and killed the shared I2P session dispatcher thread. i2ptunnel: Fix SOCKS 4/4a downgrade bypass of proxy auth (Sep 4): the guard was checking legacy proxyUsername/proxyPassword properties that are no longer used for SOCKS (we now store SHA-256 digest under different properties), so when auth was enabled an unauthenticated SOCKS 4a CONNECT was accepted. i2psnark: Improve path traversal checks (3 commits Sep 4–8). Plus i2psnark request-throttle adjustments (Sep 9), uppercase infohash in magnet names (Sep 8), restore 2-arg getNameAndInfoHash() (Sep 9), susidns CSS tweak + bump -6 (Sep 10), addressbook dest mismatch in action=update (Sep 4), SAM DG2/3 subsessions fix (Sep 4).
• Katzenpost public letter to the European Parliament (Sep 8) — front-paged on katzenpost.network: "Public letter to the European Parliament. Ahead of Thursday's Chat Control vote: Chat Control, Thursday: you are about to outlaw what you paid us to build." This is the first time a mix-network project has put a public-policy letter above the fold on its project site; the message directly equates client-side scanning with outlawing mix networks. The Katzenpost site also explicitly names Namenlos — "a public Katzenpost mix network anyone may use" as "coming next" alongside pre-built packages for katzenqt and kpclientd.
• Tor network: ~9,331 relays (Sep 8) — vs 10,137 (Sep 1). The 0.4.8 EOL cut (Sep 1) pruned ~50 relays overnight; the next ~750 relays have drained over Sep 1–8. 9,331 is the lowest relay count since the early-2024 LBTM pruning pass — likely a combination of continued 0.4.8 un-upgraded exits self-disconnecting, the cumulative Hetzner de-peering effect (Dingledine DEF CON 34: ~20% of network's relay-exit infrastructure), and normal churn. The Hard-Case-Q week on the dirauth/operational side is over; the network absorbed it.
• Privacy Guides Nym analysis (Sep 10 update) — an independent researcher vs. NymVPN thread ("Analysis of Nym VPN and its 'guaranteed' privacy") is at update 10/09/26 with multiple critical replies in the comments and the Nym team's silence noted. Not a technical bug, but a recurring brand-trust pattern that mixes into the Nym-ecosystem coverage this week.
• Research scan (Sep 5–11): ePrint keyword searches for mixnet / onion routing / anonymous communication returned no fresh first-line mixnet papers in the Sep 5–11 window. The active anchor papers remain DumboMix (2026/1699), De-SyRIS (2026/1723), Proof-of-Uniqueness (2026/1725), Verifiable SelfMix (2026/1617), QuMixnet, MOCHA (2025/861), Outfox (SIGCOMM 2025), plus the recently-approved Anonymous Communication on Expander Networks (ePrint 2026/1404, approved 2026-07-13) — a Tufts/Brown result that gives differentially-private and anonymous protocols in polylog rounds with polylog server load over expander-graph networks. The deep-research month here continues to be driven by shipping (Tor 0.4.9.12, HOPR SURB generation, Katzenpost kpclientd, Nym SDK feature gating, I2P i2psnark DoS fixes) rather than new theory.

Freedom-tech takeaway: The pattern from the last two Fridays — "the field ships the boring part" — has a sharper edge this week. Tor ships its first post-EOL security release (0.4.9.12) within one week of cutting off 0.4.8; the count is the lowest since 2024 but the network didn't collapse, just shrank to the operators who upgraded. HOPR ships a SURB protocol-version boundary (/hopr/mix/1.2.0) the week after they discovered a return-path blind spot that took down a tunnel invisibly — the answer is explicit signalling in the wire format, not more logging. Katzenpost puts a public-policy letter above the fold on the project website for the first time — the threat model is no longer purely cryptographic, it's regulatory. And I2P ships three haoxucu-reported DoS fixes in one week against the same shared dispatcher thread that any bug can take down — a reminder that anonymity networks' failure modes include "stack overflow in the receive loop". Three of these four stories have nothing to do with a new privacy primitive; they're about keeping the primitives running under load and policy pressure, which is what 2026 Q3 mixnet work looks like.

The Week in Detail

Tor 0.4.9.12: First Post-EOL Security Release + CGO Negotiation Fix

Tor 0.4.9.12 released Sep 8 with the subject line "Fwd: Tor Project Forum: Security Release 0.4.9.12" posted to oss-sec on the same day. The release contains three classes of fix:

TROVE-class security fixes (the headline): - TROVE-2026-036: Limit DNS resolution resource consumption for IP addresses with small VirtualAddrNetwork values. Tor clients with small VirtualAddrNetwork values were especially vulnerable to memory-based DoS. Bugfix on 0.2.1.29 — a 12-year-old bug class that only recently became exploitable at scale. - TROVE-2026-042: Limit the size of consensus diffs, in bytes and in lines, to prevent a class of memory-based denial-of-service attacks. Bugfix on 0.3.1.1-alpha — another long-latent bug class. - CGO negotiation fix: Negotiate CGO cryptography with every hop that supports it. Previously we failed to negotiate CGO with hops other than the final hop of a circuit. This is the follow-through to Arti 2.6.0's "CGO always-on" (Sep 1, last week's update): Arti clients now get CGO on every CGO-capable hop, not just the last one. The promotion from opt-in to always-on only matters if every hop can actually negotiate it. - Defense-in-depth (ticket 41361): Tor clients no longer accept consensus instructions to downgrade the congestion control algorithm — a hardening move tied to TROVE-2026-042-style attacks but more general. - SRV generation double-entry fix: Two SRV records that tied on every field except one previously caused honest authorities to disagree about the resulting SRV. Fixes bug 41356; bugfix on 0.2.9.1-alpha.

Operational: - Regenerated fallback directories Sep 8. - GeoIP files updated to match IPFire Location Database, retrieved 2026/09/08. - Seccomp compilation fix with recent glibc (ticket 41317). - Controller assert fix.

The release timing is the story: 0.4.8 was deprecated Sep 1, 2026; 0.4.9.12 was released Sep 8, 2026 — seven days. Tor Browser 15.0.22 (Sep 9) is the first browser bundle on 0.4.9.12. For relay operators still on 0.4.8 who somehow survived the cut, the only safe action is to upgrade.

Tor Browser 15.0.22 and the 2-Week Cadence

Tor Browser 15.0.22 released Sep 9, 2026 by ma1 — exactly 8 days after 15.0.21 (Sep 1). Changelog is a single line:

All Platforms
+ Updated Tor to 0.4.9.12

The 2-week cadence is now in steady-state. Last week was the inflection (15.0.21 + 16.0a11 in the same week, Tails 7.12 first on the new tempo). This week is the second beat: 15.0.22 eight days later, on time. The cadence is Firefox ESR-aligned: when Firefox ships a security update, Tor Browser ships within ~8 days.

Tor VPN Beta Retrospective (Sep 9, by pavel)

The first long-form writeup on how Tor VPN Beta works and what they've learned. The article is a meta-post — the product is in beta and this is the report back. Key points:

• Per-app circuit isolation — each mobile app on the device gets its own Tor circuit, rather than sharing a single tunnel. "This type of app isolation is a design choice heavily inspired by the cross-site tracking protections in Tor Browser."
• Built on Arti — explicitly stated: "Tor VPN is built on Arti, our next-generation Tor implementation written in Rust. Under the hood, that means a new, solid technical foundation rather than patching around legacy architecture."
• What doesn't yet work from C-tor — "There are still performance features from Tor's C implementation, like congestion control, that are not yet available in Arti. Bringing those capabilities over is part of what comes next." This is a public commitment that congestion control is on the Arti roadmap and that it's the main missing piece.
• WebTunnel bridges — added in 1.4.0 beta: "helps Tor traffic look like regular encrypted web traffic. This makes it harder for censors to detect and block connections."
• Reproducible builds + F-Droid — "Reproducible builds let anyone verify that the binary you're running matches the published source code, while F-Droid availability gives users a way to install and update the app without relying on Google Play."
• UX lesson from usability testing — exit selection was the wrong lever for users trying to bypass censorship; users in censorship environments should use bridges, not pick exit locations. The current design forces connecting to the Tor network first before selecting an exit to prevent the wrong choice.
• Where it's used — "strong adoption in highly censored regions, including Iran and Turkmenistan. This stood in contrast to Tor Browser for Android, which tends to skew more toward users in the Global North."
• Future work — exit selection to be reintroduced "in a way that doesn't create user error in high-risk situations"; more congestion control / perf features from C-tor; broader mobile support.

The Sept 9 release is the closest thing to a "Tor VPN 1.0 roadmap" the project has published: Arti-based, per-app circuits, WebTunnel bridges, reproducible, F-Droid available, with congestion control as the named missing piece.

NymVPN v2026.12.4-beta.4 (Sep 10) and the Three-Beta Sprint

The Sep 3 release was .beta.1; the team then shipped .beta.2 (Sep 9, 18:03), .beta.3 (Sep 10, 14:54), .beta.4 (Sep 10, 18:00) — three betas in 23 hours. This is an unusually fast iteration cadence for NymVPN (the prior 12.3 → 12.4-beta.1 was a week). What's in beta.4:

Pattern: Of the 12 items, 4 are reliability/anti-leak (#6261, #6265, #6213, #6245), 3 are connection-resilience (#6308, #6237, #6087), 3 are correctness (#6272, #7150, #6294), 1 is credential (#6258), 1 is platform panic (#6316). The release is essentially "make NymVPN not drop, leak, or panic on flaky networks". The next stable (12.4) will land when these stabilize.

Nym Main Repo: crates 1.22.0, SDK Feature Gating, LP Clock-Skew

12 PRs merged Sep 4–10 in nymtech/nym:

The two structural items: #7139 (crates 1.22.0) is the version bump that ties all of this together. #7123 (SDK feature gating) is the architectural move toward lightweight WASM/embedded clients that can pick the subsystems they need. Together they tell the same story: the next client shape isn't "full SDK everywhere" — it's "pick the features you need".

HOPR #8365: SURB Protocol-Version Boundary

PR #8365 (feat(session)!: generation-tagged SURB consumption, Sep 9) is the most consequential protocol change in HOPR since the SURB-ID rework. From the PR body:

⚠️ SIGNIFICANT BEHAVIOR DIVERGENCE FROM 4.0

When a return path dies deep in a 1–3 hop forward or return route, the failure is invisible to the replying side — only the SURB creator, seeing which replies never came back, can tell. This change makes the return-path identity explicit so the replying side can react precisely rather than by heuristic.

The mechanism:

1. Creator stamps every SURB batch with a generation — a dedicated u8 (RFC-1982 serial) in SurbReceiverInfo.
2. Creator advances generation on every return-path re-plan.
3. Replier keeps only the highest generation it has seen — the first push carrying a newer generation clears the per-pseudonym buffer wholesale, so SURBs for the superseded (and possibly dead) path are dropped at once and the next reply uses the live path.
4. Generation tagging is orthogonal to SurbPopOrder — FIFO is the default; LIFO remains fully functional. The two mechanisms compose: generation tagging handles an explicit re-plan; the pop order chooses consumption order within a generation.

The cost:

The SURB wire size grows by one byte, so this is a protocol-version boundary: nodes across the boundary cannot exchange SURBs. The /hopr/mix/1.2.0 bump enforces the boundary in code — mixed-version nodes will not establish the mix protocol — so ship this as a coordinated release.

This is the HOPR equivalent of Tor's CGO wire-format bump: a small change in the packet structure that breaks compatibility at the protocol boundary. The semantic difference is return-path liveness becomes part of the wire format, not just a runtime signal.

The week's other HOPR items:

• #8393 (Sep 10) — chore(deps): bump the nix-flake-inputs group with 4 updates. Dependency hygiene.
• #8384 (Sep 9) — fix(session): capture SURB generation at path resolution, not encode. Companion fix to #8365 — make sure the generation is captured when the path is resolved, not when the SURB is encoded (otherwise path re-resolutions between encode and send would lose the generation).
• #8396 (Sep 8) — feat(session): PIX fill keeps funded cycles on course when the client is idle. PIX (Payment-In-channel eXchange) supervision continuation: a funded cycle stays funded when the client is idle (no spurious top-up on idle).
• #8385 (Sep 7) — feat(pix): make the SSA commitment retransmittable. SSA (Session-Source-Account) commitments can now be retransmitted by a session supervisor on behalf of the client.
• #8377 (Sep 3, prior week carry-over) — feat(session): parameterize PIX admission by Session target. Per-session admission policy.
• #8381 (Sep 3) — test(transport): make the head-of-line-blocking guard deterministic. Test reliability.
• #8368 (Sep 3) — feat(transport): surface return-path relayer-diversity blind spots. The diagnostic that complements #8365: when the return stream collapses onto a single relayer, the per-relayer degradation detector can't act (no sibling relayer still delivering). Diagnostics added to path selector (WARN when return path resolves to single relayer), path planner (debug-log return-path draw), and SURB telemetry. Companion to hoprnet/edge-client#155.
• #8374 (Sep 1, prior week carry-over) — fix(transport): time out and evict a stalled write-pump sink to stop egress head-of-line blocking. The OOMKilled-class fix: a single stalled peer took jura-dev OOM after 10h of linear memory growth. StallGuardSink<S> wraps the framed writer with an idle timeout. Field signature was hopr_egress_ring_buffer_dropped pinned at exactly 0.50/s for 10+ hours.

The trio of #8365 + #8368 + #8374 is HOPR's return-path robustness trilogy, completed this week: the wire-format signal (#8365), the diagnostic that surfaces when the signal is missing (#8368), the eviction that prevents one stuck peer from OOMing the whole node (#8374).

Katzenpost: NoOp Heartbeat, kpclientd Hardening, Chat Control Letter

The Katzenpost repo shipped 17 merged PRs Sep 4–10 in addition to the network-facing changes already documented in last week's update.

Network-facing: - #1133 (Sep 8): client: send a NoOp heartbeat to the gateway on idle connections. The idle client's only traffic was one GetConsensus2 per epoch, which could race the gateway's 2-minute read timeout and get disconnected mid-epoch. Mirrors the NoOp heartbeat the gateway already sends. Operational correctness — without this, idle connections drop silently every 2 minutes. - #1132 (Sep 7): cmd: add version flags to remaining commands. Operator-tooling hygiene.

Cbor plugin startup diagnostics thread (Sep 4–8, 6+ commits): - #1130 (Sep 6): Cbor plugin startup diagnostics — the umbrella PR. Fix the various bugs that prevent the cbor plugin startup failure from being reported to the operators in the service node log. "If a given cbor plugin fails to start, then at the very least the service node should print the plugin error to its log. Why? Because service nodes start the plugins so they can receive error text from stderr, and because the error text may help the operator diagnose problems." - bfd52e7 (Sep 6): server: stop double-printing the provider-backend startup error. - 1fbc8a3 (Sep 6): server: log a one-line summary of provider-backend startup failures. - 86b7c9d (Sep 6): cborplugin: close the test log backend before TempDir cleanup. - 93d956e (Sep 6): kaetzchen: stop double-logging plugin startup failures. - ab4575e (Sep 6): cborplugin: converge plugin init failures on one clean exit path. - e527556 (Sep 6): cborplugin: fail fast with captured stderr on plugin startup failure.

The cluster is operator-experience work: when a service node fails to start, the operator needs to see one clean error message in the log, with stderr captured, and not double-printed. This is the same UX thread as last week's silent-packet-drop instrumentation (#1114).

kpclientd hardening (Sep 7): - #1115 (Sep 7): kpclientd: fix shutdown hang and connection races. Shutdown hang that was waiting for connections to drain; races between accept loop and shutdown. - #1118 (Sep 7): kpclientd: multiple unix listener sockets with stale-socket repair. The big UX win. [Listen.Unix].Addresses lets the daemon bind several unix sockets at once, in any combination of filesystem paths and leading-@ abstract names. A single Address behaves exactly as before, so existing configs are unaffected. A crashed kpclientd leaves its filesystem socket file behind, so the next bind would fail with EADDRINUSE. Each socket is bound through a repair step: on EADDRINUSE, if the path is a socket that no live daemon answers on (a dial is refused), the stale file is removed and rebound once. A socket a live daemon still answers on is left in place, so a second instance cannot evict a running one. Abstract sockets never outlive their owner, so EADDRINUSE there is a live owner and is passed through. - #1118 also combines the prior multi-socket PR and the stale-socket-repair PR into one change.

Resilience + tooling (Sep 4–6): - #1129 (Sep 6): docker: put base port seed in compose project name. The local-dev docker mixnet had colliding ports across services; put the port seed in the compose project name so each deployment has its own port namespace. - #1127 (Sep 4): client/config: fix race condition in TestUnmarshalTOML. CI reliability. - #1126 (Sep 4): genconfig: add proxyWorkerCount and proxyRequestTimeout flags for replica. Operator-configurable replica scaling. - #1125 (Sep 4): pin latest hpqc to get the thinclient-diet changes. The Katzenpost post-quantum crypto library shipped a thin-client-diet that needs to land in katzenpost. - #1124 (Sep 4): client/thin: bound the resend wait with an optional context. Resend can be cancelled now. - #1123 (Sep 4): client: wait longer than the worst-case round trip in sendAndWait. Don't give up before worst-case. - #1122 (Sep 4): courier: retry a transient replication failure during Copy. Replication resilience. - #1121 (Sep 4): replica: give the silent-holder failover test a slow-CI budget. CI reliability.

Plus a project-level event: Katzenpost public letter to the European Parliament is now front-paged on katzenpost.network. The full text opens:

Public letter to the European Parliament. Ahead of Thursday's Chat Control vote: Chat Control, Thursday: you are about to outlaw what you paid us to build.

The site also names Namenlos — "a public Katzenpost mix network anyone may use" — as "coming next" alongside pre-built packages for katzenqt and kpclientd. This is the first time Katzenpost has named a public mixnet as a near-term deliverable.

I2P: haoxucu Week — Three DoS-Class Fixes + Path Traversal

I2P Java I2P shipped 11 i2p.i2p commits Sep 4–10, all on the security/hardening thread (all reported by haoxucu, the same researcher who reported the SOCKS auth bypass and the bdecode recursion):

CVE-class (security-critical): - b6ce258 + b12dfad + 0d801ff (Sep 4 + Sep 8): i2psnark: Improve path traversal checks (3 commits). Path traversal hardening in the BitTorrent client's file-handling path. - 641f06f (Sep 4): i2psnark: Catch unbounded bdecode recursion. BDecoder applied no recursion limit to untrusted bencode, so a large nested list/map produced StackOverflowError that passed through every catch(Exception) on the receive path and killed the shared I2P session dispatcher thread. Fix by declaring and catching Throwable everywhere. This is the kind of bug that takes down the whole router on a single peer-supplied torrent. - ff63e0c (Sep 4): i2ptunnel: Fix SOCKS 4/4a downgrade bypass of proxy auth. The guard meant to reject SOCKS 4/4a on auth-enabled tunnels checked for legacy proxyUsername/proxyPassword properties that are no longer used for SOCKS (we now store SHA-256 digest under different properties), so when auth was enabled an unauthenticated SOCKS 4a CONNECT was accepted. Fix by removing check for legacy properties.

Operational: - a884b90 (Sep 4): Addressbook: Check for dest mismatch in action=update. Addressbook correctness. - d2392ae (Sep 4): SAM: Fix DG2/3 subsessions. SAM bridge protocol fix.

i2psnark hardening (Sep 8–10): - 7852931 (Sep 8): i2psnark: Use uppercase for infohash in magnet names. Cosmetic but standardizing. - 2f0fb93 (Sep 9): i2psnark: Request throttle adjustments. Anti-DoS throttling. - 3f17761 (Sep 9): i2psnark: Restore 2-arg getNameAndInfoHash(). Compatibility fix.

Misc: - 77f8827 (Sep 10): bump -6. Internal version bump. - cff95a3 (Sep 10): susidns: CSS tweak. UI polish.

No I2P core release this week — I2P 2.13.0 (Jul 24, 2026) remains current. I2P 2.14.0 with the Hybrid MLKEM SSU2 release is still targeted for October 2026 per proposal 169.

Tor Network: ~9,331 Relays (Sep 8) — Lowest Since Early-2024

The relay count trajectory over the post-0.4.8-EOL week:

~9,331 relays (Sep 8) is the lowest count since the early-2024 LBTM pruning pass. The trajectory since Sep 1 (10,137 → 9,331) is a ~8% drop in 7 days. The pre-existing Hetzner de-peering (Dingledine DEF CON 34: ~20% of network's relay-exit infrastructure) and the 0.4.8 EOL cut-off are the most likely explanations. The network did not collapse — it shrank to the operators who upgraded, plus whatever un-upgraded exits self-disconnected over the week.

The network appears to have stabilized around the ~9.3K range — not back to ~10.5K where it sat in mid-2026, but no longer in free-fall. The 2-week browser cadence + the new Tor VPN Beta Arti build should draw modest new-user attention (and modest new-relay donations in the long run) but no immediate surge.

Research Scan: Sep 5–11

ePrint keyword searches for mixnet, onion routing, anonymous communication returned no fresh first-line mixnet papers in the Sep 5–11 window. The active anchors remain:

• DumboMix (ePrint 2026/1699, async anonymous broadcast with G.O.D. via Shamir-share MPC, O(1) multiplicative depth)
• De-SyRIS (ePrint 2026/1723, decentralized Sybil-resistant identity without trusted issuer)
• Proof-of-Uniqueness (ePrint 2026/1725, threshold-OPRF Sybil-resistant pseudonymous DIDs)
• Cao & Green reputation-framing attacks on Nym (ePrint 2026/101)
• Verifiable SelfMix (ePrint 2026/1617)
• QuMixnet (post-quantum mixnet protocol)
• MOCHA (ePrint 2025/861, IH&MMSEC 2025, Loopix client-anonymity measurement)
• Outfox (ACM SIGCOMM 2025, simplified Sphinx for PQ)
• Anonymous Communication on Expander Networks (ePrint 2026/1404, approved 2026-07-13) — Tufts/Brown result: differentially-private and anonymous protocols in polylog rounds with polylog server load over expander graphs.

The pattern continues: measurement + committee-based alternatives + expander-graph anonymous protocols, while the shipping work consolidates the existing primitives (CGO always-on in Arti; SURB generation in HOPR; kpclientd Unix multi-socket in Katzenpost; SDK feature gating in Nym).

Out-of-Scene but Adjacent

• Privacy Guides Nym analysis (Sep 10 update) — the independent researcher vs. NymVPN thread is now at update 10/09/26 with sustained criticism and Nym team silence noted. The thread "Nym Mixnet: privacy theater" (Aug 8) and "NymVPN (Nym)" are also active. Not a technical bug, but a recurring brand-trust pattern.
• EU Chat Control — the July 2026 EP vote extended Chat Control 1.0 until April 2028; the Council now has ~3 months (until ~October 9) to decide on Chat Control 2.0 amendments. The Katzenpost letter is directly tied to this — the EP civil-liberties committee position rules out mass surveillance and protects encryption, but the Council could weaken it. The Katzenpost letter is the first time a mix-network project has put a public-policy letter above the fold on its project site.

Evidence at a Glance

Primary sources

• MOCHA: ePrint 2025/861