Mix Networks Friday — September 18 2026 Weekly Update

Weekly companion to the Mix Networks 2026 Research and Deployment Tracker and Overview - Mix Networks. This week is shipping + dirauth hardening week. Tor Browser 15.0.23 (Sep 15) is the second post-0.4.9.12 point release in six days — it ships Firefox 156 backports (140.16.0esr), NoScript 13.6.33.1984, two P1 WebAssembly-capable child realm fixes (tor-browser#45296 SharedWorker Identity Mismatch + tor-browser#45297 missing setHTMLUnsafe hook — both H1 severity, WebAssembly execution at the Safer level), and a publicly-disclosed expired DigiCert EV code-signing certificate for Windows installation packages (expired Sep 1, renewal delayed; Windows download page keeps 15.0.20 as the workaround while relying on the separately-signed auto-update channel). Tails 7.13 (Sep 16) is the second Tails on the new 2-week cadence — bundles Tor Browser 15.0.23 + Tor 0.4.9.12 and removes the Power Off confirmation dialog for the fast-path shutdown. HOPR ships three PIX/transport PRs in two days (Sep 15–17) — the headline is #8424 fix(transport): derive packet-pipeline concurrency defaults from CPU count which reverts the 4.1.x relay-throughput regression vs. 4.0.3 by replacing the pool_thread_count − ENCODE_RESERVED_THREADS cap (which clamped to 1 on 4-core nodes) with available_parallelism × 8; #8426 feat(transport): pool arbitration layers a first-wins occupancy-gated arbiter on top so SURB encode is protected from decode floods with 2.1× SURB encode throughput under a decode flood and zero overhead for pure forwarding. Katzenpost ships an entire dirauth hardening sweep (Sep 14–17, ~15 commits, +1,283 LOC including the 444-line #1138 "review the voting directory authority" PR) that closes a wire-protocol class of panics in the consensus path (ed25519 Sphincs+ Verify panic on a wrong-sized signature; ChaChaPoly nonce desync under concurrent sends; missing vote/reveal/sig → peer identity binding; missing-shared-random-reveal stalls the round; oversized wire messages vs. real network topology) and adopts hpqc's v0.0.87/v0.0.88/v0.0.89 degenerate-key hardening — hpqc NIKE/KEM primitives now return errors instead of panicking on low-order peer points and CTIDH base curve E0. Nym releases v2026.18-essaouira (Sep 17) as the first release-branch cut since v2026.17-djibouti (Sep 2) — it's the lock-free topology PR #7134 plus geolocator container image, ansible-maintenance rewrite, residential-IP operator guides (vps/byoip/isp/mobile/home/swiss), and cred-proxy key bug fixes. I2P ships a Tim C-reported hardening sweep (Sep 16, 5 commits): constant-time EdDSA sig comparison + constant-time AES in deprecated/unused method (both reported by Tim C, defensive against side-channel); Tunnels: Don't process dup fragments + Tunnels: Limit size of fragment reassembly map (both by Tim C, both DoS-relevant on attacker-controlled fragment floods); i2psnark: Limit max reported peers to protect against tracker bugs + i2psnark: Extend keepalive interval from 30 to 60s, only send on inactivity (i2psnark network-etiquette hygiene); i2control: Log and delay on auth failure (anti-bruteforce). Chat Control 2.0 negotiations resumed at the Council on Sep 12; no final deal yet — Katzenpost's letter remains front-paged and the previously-reported "~3 months / ~Oct 9 deadline" is the next material date. The Tor network stabilized around 9,330 running relays (essentially unchanged from 9,331 last week) — the post-EOL drain is over.

TL;DR — This Week

• Tor Browser 15.0.23 (Sep 15) — second post-0.4.9.12 point release in six days; Firefox 140.16.0esr rebase (tor-browser#45303), Firefox 156 security backports (tor-browser#45299), NoScript 13.6.33.1984; two H1-severity WebAssembly-at-Safer-level fixes (tor-browser#45296 SharedWorker Identity Mismatch + tor-browser#45297 missing setHTMLUnsafe hook) — both allow WebAssembly execution at the Safer level which should be sandboxed; public disclosure of the expired DigiCert EV code-signing certificate for Windows installation packages (expired Sep 1, renewal delayed) — Windows download page keeps 15.0.20 as the workaround, users on 15.0.21/15.0.22 see "bad signature" warnings on fresh installs (auto-update channel uses a different key, so installed users are unaffected); tor-browser-build#41871 + #41875 update relprep.py for the new versions.ini URL.
• Tails 7.13 (Sep 16) — second Tails on the new 2-week cadence (7.12 Sep 3 → 7.13 Sep 16, 13 days). Bundles Tor Browser 15.0.23 + Tor 0.4.9.12; removes the Power Off confirmation dialog on the fast-path shutdown (when no application needs to be closed and no document needs to be saved) — the visible UX change.
• HOPR PIX/transport trilogy lands in two days (Sep 15–17) — #8424 (Sep 17) fixes the 4.1.x relay-throughput regression (a 4-core node's ingress decode-concurrency default clamped to 1 from pool_thread_count − ENCODE_RESERVED_THREADS = 2 − 2 = 0); #8426 (Sep 17) adds the occupancy-gated encode/decode pool arbiter so SURB encode is protected from decode floods while pure forwarding pays zero overhead; #8411/#8412/#8413 (Sep 16) are the PIX Exit telemetry stack (bounded node-level aggregates, no PII: hopr_pix_sessions_active{gate_mode}, hopr_pix_cycles_active{phase}, hopr_pix_gate_blocks_total{reason}, hopr_pix_cycle_egress_packets{outcome}). Also: #8420/#8422 (Sep 15) are the datagram-aware UDP copy loop end-to-end — WireGuard-over-Session downloads on the Gnosis VPN exit were collapsing because the copy loop was coalescing several return-path UDP datagrams into one oversized session write under backpressure, losing datagram boundaries irrecoverably. And #8430 (Sep 17) drops pix_ssa_quota from SessionClientConfig because PIX dimensions were never a per-Session choice — Capability::UsePIX is now the whole per-Session PIX switch.
• Katzenpost dirauth hardening sweep (Sep 14–17, ~15 commits) — the headline is #1138 (Sep 17, 444-line "review the voting directory authority" PR) by the og-clean branch which rejects bad input instead of panicking (Addresses, short descriptor identity keys), guards the shared-random and certificate paths (set-commit, cert epoch binding, vote-as-cert, reveal bounds, authenticator AD), gives the PKI wire message a real size ceiling derived from the configured schemes and topology, recovers per-conn panics, caps concurrent and per-peer conns, logs and drops unknown peers, bounds the first command and keepalive writes, and drains accepted conns on shutdown; persistent inter-authority connections stay opt-in, default off. #1154 (Sep 17) bumps hpqc to v0.0.89 (BACAP API breaking changes); v0.0.87 + v0.0.88 land earlier in the week with the degenerate-key hardening adoption (#1136 Sep 14, nine commits Sep 14: reject all-zero shared secrets via util.CtIsZero in sphinx packet creation and unwrap, reject nil Scheme.Blind result, reject all-zero in-place Blind result, reject degenerate KEM key in createKEMHeader). This is the most consequential dirauth hardening pass Katzenpost has shipped.
• Nym v2026.18-essaouira (Sep 17) — first release-branch cut since v2026.17-djibouti (Sep 2, 15 days). Merge #7161 lands release/2026.18-essaouira → develop on Sep 17 12:09. Headline items: lock-free topology (#7134, Sep 15) — the biggest single-PR change in this cut; geolocator container image CI (Sep 17); #7162 nym-node-cli location handling UX (Sep 17); #7157 nym-node ansible system maintenance + log rotation (Sep 17); residential-IP operator research document (#7153 Sep 14, six subsections: vps/byoip/isp/mobile/home/swiss); cred-proxy key bug fixes (#7145 Sep 14); node-lookup additional logging (#7154 Sep 15); residential-IP display fix (#7155 Sep 15). NymVPN — NymVPN F-Droid still 3+ weeks behind (GrapheneOS forum report: F-Droid's last build was 2026.11.3 from July 28; GitHub has 2026.12.4-beta.4).
• I2P Tim C hardening sweep (Sep 15–16, 6 commits) — all reported by Tim C: crypto: make EdDSA sig comparison constant time (defensive against side-channel timing); crypto: make AES operation constant time (in deprecated/unused method — defense in depth); Tunnels: Don't process dup fragments (DoS-relevant on attacker-controlled fragment floods); Tunnels: Limit size of fragment reassembly map (DoS — bound the unbounded-growth class); i2psnark: Limit max reported peers (tracker-bug defense); i2psnark: Extend keepalive interval from 30 to 60s, only send on inactivity (network etiquette); i2pcontrol: Log and delay on auth failure (anti-bruteforce). Also Sep 13–14 i2psnark work: add all trackers to magnet links, set next announce based on last response time (not request time, so failures get retried faster), change backup tracker to UDP and add to tracker list. Transport work (Sep 14, WIP): partial force-ipv6 for docker bridge, explicit force-ipv6 enum, stub NATPMP enums.
• Chat Control 2.0 negotiations resumed (Sep 12) — the Council was scheduled to finalize Member State positions; no final deal reported as of Sep 18. The Danish Presidency is pushing for CSAM scanning; 6 Member States publicly opposed (Austria, Belgium, Czech Republic, Finland, Netherlands, Poland); Germany under Merz coalition "undecided"; Estonia, Greece, Luxembourg, Romania, Slovenia "undecided"; mult-party opposition in EP (Greens/EFA VOLT, Patriots for Europe incl. Filip Turek, Finnish EPP MEP Aura Salla). Katzenpost's letter remains front-paged. The previously-reported "~3 months / ~Oct 9 deadline" from the July EP second-reading procedure is the next material date.
• Tor network at 9,330 running relays (Sep 18) — essentially flat from last week's 9,331 (Sep 8). Exit count holds at ~3,140. The post-EOL drain has stopped; the network has settled into the new post-0.4.8 equilibrium. Not back to the mid-2026 ~10.5K but no longer in free-fall.
• Research scan (Sep 12–18) — ePrint keyword searches for mixnet / onion routing / anonymous communication returned no fresh first-line mixnet papers in the window. The active anchors remain DumboMix (2026/1699), De-SyRIS (2026/1723), Proof-of-Uniqueness (2026/1725), Verifiable SelfMix (2026/1617), QuMixnet, MOCHA (2025/861), Outfox (SIGCOMM 2025), Anonymous Communication on Expander Networks (2026/1404).

Freedom-tech takeaway: This is "the boring part matters" taken to its logical extreme. Tor ships two H1-severity WebAssembly-at-Safer fixes in the same point release that bumps Firefox 140.15 → 140.16 — the WebAssembly-at-Safer class is a long-latent failure mode where the sandboxed JS realm was supposed to be safe but a missing hook leaked a child realm that could execute WebAssembly. HOPR ships the 4.1.x relay-throughput regression fix in 10 days from identification (the gauge hopr_egress_ring_buffer_dropped pinned at 0.50/s was the tell) and pairs it with a pool arbiter so the fix is forward-compatible with the original design intent. Katzenpost ships a 444-line dirauth review that closes a half-dozen panic classes and adopts hpqc's degenerate-key hardening throughout — the wire-protocol size ceiling, in particular, is the kind of bug that lives in the protocol spec until a heterogeneous authority set is actually deployed. I2P ships six constant-time and DoS-bounded fixes in two days, all reported by a single researcher — a reminder that the Tor browser's WebAssembly-at-Safer class isn't unique to Tor. Nym cuts its first release-branch in 15 days with the headline being lock-free topology — a single PR that changes the topology-read path from a RwLock to a lock-free structure, which is the kind of change that doesn't move benchmarks but matters under contention. The week's banner story is "every deployable mixnet shipped something the field needed but didn't have a release note for last week".

The Week in Detail

Tor Browser 15.0.23: Two H1 WebAssembly-at-Safer Fixes + Firefox 156 Backports + Expired Code-Signing Cert

Tor Browser 15.0.23 released Sep 15, 2026 by ma1. The cadence continues: 15.0.22 (Sep 9) → 15.0.23 (Sep 15) = 6 days. With Tails 7.13 adopting the new 2-week tempo on Sep 3, the Firefox-aligned cycle is now a mix of: regular 2-week Tor Browser releases + faster point releases when a Firefox security fix lands.

The changelog:

All Platforms
+ Updated NoScript to 13.6.33.1984
+ Bug tor-browser#45296: (H1) SharedWorker Identity Mismatch allows WebAssembly execution at Safer
+ Bug tor-browser#45297: (H1) Missing setHTMLUnsafe hook leaves a permanent WebAssembly-capable child realm at Safer
+ Bug tor-browser#45299: Backport Security Fixes from Firefox 156
+ Bug tor-browser#45303: Rebase Tor Browser stable onto 140.16.0esr
+ Bug tor-browser-build#41875: Update relprep.py for the new versions.ini URL
Windows + macOS + Linux
+ Updated Firefox to 140.16.0esr
Linux
+ Bug tor-browser#44996: Change the 32-bit linux message to the expired version for the final 15.0 release
Android
+ Updated GeckoView to 140.16.0esr
Build System
+ All Platforms
  - Bug tor-browser-build#41871: Update downloads repository references in relprep templates

The two H1-severity WebAssembly-at-Safer fixes are the most security-critical items in the release:

• tor-browser#45296 (H1) — SharedWorker Identity Mismatch allows WebAssembly execution at Safer. Tor Browser's security levels (Standard, Safer, Safest) constrain WebAssembly to specific security levels — at Safer, WebAssembly should be sandboxed to the realm's origin. A SharedWorker's identity mismatch allowed WebAssembly execution at a level below where it should be allowed, bypassing the security-level boundary. The fix matches the SharedWorker's identity to the realm's identity for security-level checks.
• tor-browser#45297 (H1) — Missing setHTMLUnsafe hook leaves a permanent WebAssembly-capable child realm at Safer. The setHTMLUnsafe hook is one of the per-realm guards that the Tor Browser patches add to constrain WebAssembly execution to specific security levels. A missing hook for one method left a child realm permanently WebAssembly-capable at Safer — which should be impossible under the Tor Browser security model.

Both bugs were reported through Mozilla's bug bounty program and given H1 (highest severity) ratings — the WebAssembly-at-Safer class is exactly the failure mode the Tor Browser security patches are designed to prevent. Both fixes ship in 15.0.23.

The Windows code-signing cert disclosure (from the Tor Project blog):

The DigiCert EV code-signing certificate we use to sign Windows installation packages is expired since September 1st and we are currently in the process to renew it. Unfortunately, this process is delayed and not yet complete. This has caused Windows users trying to install Tor Browser 15.0.21 and 15.0.22 from scratch to receive "bad signature" warnings. As a temporary work-around, for Windows only we're keeping Tor Browser 15.0.20 (the latest correctly signed version) listed on our download page, relying on automatic updates (which are signed with a different key, not involving this expired certificate) to bring Windows users to the current version. Users who prefer to download the latest version directly, ignoring the certificate expiration warning, can download it from https://dist.torproject.org/torbrowser/15.0.23/.

This is a publicly-disclosed operational issue with a clean workaround: - Windows download page still lists 15.0.20 (the last release signed with the unexpired cert). - Auto-update channel uses a different key (not the expired EV cert), so installed users get upgraded to 15.0.23 cleanly. - Fresh Windows installers from dist.torproject.org/torbrowser/15.0.23/ work but trigger "bad signature" warnings. - macOS and Linux users are unaffected — different signing mechanism.

The blog post is dated Sep 15 and explicitly tells users the workaround; this is the right way to disclose an expired-cert issue (public, workaround included, no security impact for installed users).

Build-system changes: - tor-browser-build#41871 — Update downloads repository references in relprep templates (i.e. the release-prep scripts now point at the right downloads repo). - tor-browser-build#41875 — Update relprep.py for the new versions.ini URL (Mozilla changed where versions.ini lives; the release-prep scripts need to track the new location).

These are the unglamorous but essential plumbing changes that keep the release-train moving. The Firefox-aligned 2-week cadence lives or dies on this kind of hygiene.

Tails 7.13: Second Tails on the New 2-Week Cadence

Tails 7.13 released Sep 16, 2026 by the Tails team. The cadence: 7.12 (Sep 3) → 7.13 (Sep 16) = 13 days. That's right in the middle of the 2-week target (10–14 days), and consistent with the Firefox-aligned tempo.

Changes and updates:

Update Tor Browser to 15.0.23.
Update the Tor client to 0.4.9.12.
Simplify the shutdown procedure.

The headline UX change is simplification of the shutdown procedure:

Since Tails 7.10, you had to confirm shutting down in a Power Off dialog. For faster shutdowns, we removed this dialog when no application needs to be closed and no document needs to be saved before shutting down.

This is a small thing, but it's the kind of friction reduction that matters for a Tails user who is shutting down urgently (e.g. they think they're being observed). The dialog is preserved for the cases where it's needed (open applications, unsaved documents); the fast-path is now one click faster.

Tails 7.13 also continues the automatic-upgrade path from Tails 7.0+, and remains based on Debian 13 (Trixie) + GNOME 48 (the platform from Tails 7.0 in early 2026).

The combined ship this week: Tor Browser 15.0.23 + Tails 7.13 + the 0.4.9.12 release from Sep 8 — every user-facing component of the Tor stack is now on the same release-cycle tempo.

HOPR PIX/Transport Trilogy: 4.1.x Throughput Regression Fix + Pool Arbiter + PIX Exit Telemetry Stack

HOPR shipped a dense cluster of PIX and transport-layer PRs Sep 15–17. The headline is the 4.1.x throughput regression fix (PR #8424) and the pool arbitration design (#8426), both written by Claude Opus 4.8 / 5 in the agent-traceable style that's become characteristic of recent HOPR PRs.

#8424 (Sep 17) — Derive Packet-Pipeline Concurrency Defaults from CPU Count

The 4.1.x line regressed relay throughput relative to 4.0.3. Field measurements pinned it to the relays, not the exit: throughput collapsed only when the relays ran 4.1.x, regardless of the exit's version.

The cause: the ingress decode-concurrency default introduced in #8246. That change capped the default at pool_thread_count − ENCODE_RESERVED_THREADS to keep encode threads free for SURB generation on a busy exit. But in production the shared Rayon pool is sized to available_parallelism()/2, so on a 4-core node the default evaluates to 2 − 2 = 0, which clamps to 1 — the node decodes packets essentially one at a time. Because forwarding is decode-only, a relay carries no encode/SURB work for that reservation to protect, so the cap was pure loss there, and since a session is bidirectional, throttling one relay direction dragged down both download and upload.

The fix: the default is now derived from the CPU count rather than the pool size — both the decode and encode stages fall back to available_parallelism × 8 — the pre-#8246 deep-queue depth. These values are ready-queue depths feeding the shared pool, not thread counts, so tying them to the (smaller) pool size was the category error that produced the collapse. The ingress throttle mechanism is unchanged; its watermark simply scales with the corrected concurrency.

This intentionally restores the encode/decode balance to its pre-#8246 behaviour. The original goal of that change — protecting encode/SURB generation from decode floods under a congested shared pool — is real, but it belongs in a follow-up that arbitrates the pool dynamically.

#8426 (Sep 17) — Pool Arbitration (the Follow-Up to #8424)

Task 2 of the #8246 fix on master: wires the encode/decode pool arbiter into the packet pipeline. Task 1 (#8424) restored CPU-derived concurrency defaults, fixing the relay forwarding collapse; this PR removes the per-packet ingress sleep-gate and replaces it with an asymmetric, occupancy-gated arbiter (in hopr-utilities) that protects SURB encode from decode floods without ever throttling pure forwarding.

The arbiter only throttles decode admission when the shared pool is saturated, encode work is present, and decode genuinely floods relative to encode — so a forwarding relay (encode ≈ 0) and any unsaturated node are never affected. It is configured first-wins (configure_arbitration_once) because the pool is process-global: a per-node pipeline startup cannot clobber a peer's arbiter or an explicit benchmark override. PoolArbitrationConfig { enabled, occupancy_pct, encode_reserve_pct } is operator-tunable with range validation.

Measured with real SPHINX op costs on a pinned pool: SURB encode ~2.1× protected under a decode flood with halved P99, and zero overhead for forwarding, balanced, and encode-heavy regimes.

This is the structural answer to #8424: the previous fix preserved the encode/decode balance by giving each stage its full available_parallelism × 8; this fix adds back the original #8246 protection for encode (SURB generation) against decode floods — but only when encode work is actually present and decode is genuinely flooding relative to encode. A pure-forwarding relay pays nothing. A balanced relay pays nothing. Only the case #8246 was originally trying to fix (busy exit with concurrent encode and decode, decode flooding) gets throttled, and even then only when the pool is actually saturated.

#8411 / #8412 / #8413 (Sep 16) — PIX Exit Telemetry Stack

A three-PR stack that adds bounded node-level PIX Exit telemetry with no PII labels.

• #8411 (Sep 16) — feat(session): bounded node-level PIX Exit telemetry: eight bounded aggregates under hopr_pix_* — hopr_pix_sessions_active{gate_mode} (live Sessions, funded vs unfunded), hopr_pix_cycles_active{phase}, hopr_pix_predeposit_exposure_packets (service given away, not yet paid for), hopr_pix_cycles_total{event} (requested / committed / funded / recovered / failed), hopr_pix_admission_rejections_total{reason} (why incoming PIX Sessions were refused), hopr_pix_live_cycle_bytes + _reserved_total / _released_total (reconstructor-cycle budget). The two existing per-Session gauges are unchanged — this adds alongside. The identifier deny-list guard lives in generate-metrics-docs.sh (run by the pre-commit hook) so a regression that adds a session_id label fails in CI.
• #8412 (Sep 16) — feat(session): PIX egress gate pressure telemetry: ServiceGate::try_acquire_sync returns a GateVerdict instead of a bool. Both refusal sites already knew which case they were — this only stops discarding it. New metrics: hopr_pix_egress_packets_total{mode}, hopr_pix_gate_blocks_total{reason} (predeposit_exhausted / share_lag / closed), hopr_pix_gate_block_seconds{reason}. Counting is episodes, not refused packets — a blocked gate is polled again by whoever is sending, so counting refusals would measure how hard the caller retries rather than how long the Exit was stalled. Episode is an RAII guard opened at the refusal — not at first poll, since the refusal has already happened — and closed by Drop. Benchmarks: funded path 31 µs (unchanged), predeposit path 60 µs (+3.7 ns/packet, under 4 µs for a whole rotation at the shipped value).
• #8413 (Sep 16) — feat(session): PIX share and per-cycle recovery coverage telemetry: hopr_pix_shares_total{kind} (newly accepted shares, useful vs surplus), hopr_pix_cycle_egress_packets{outcome} (what a cycle cost, observed once at finalization), hopr_pix_cycle_useful_share_fraction{outcome}, hopr_pix_cycle_accepted_share_fraction{outcome}. Design note: absolute snapshots, never summed. SsaRecoveryProgress is absolute and acknowledgement batches arrive out of order, coalesced, or not at all, so shares_seen must never be added to a counter. The supervisor keeps a high-water mark per cycle; the delta against it is taken at the one point where a snapshot is known to be both validated and newer than everything before it.

Plus OTLP.md documenting the hopr_pix_* / hopr_session_pix_* exporter split and worked PromQL for every operator question the issue lists.

Other HOPR PRs this week

• #8420 (Sep 15) — fix(surb-store): keep newest reply openers so sustained uploads survive. The same fix as #8417 (v4.0 line) on master: the inner per-pseudonym reply-opener cache was built with no eviction policy, so it uses moka's default Window-TinyLFU. Reply openers are written once and never read before they are used, so every entry carries the same zero access frequency and TinyLFU keeps the incumbent on each tie — a full cache freezes the oldest openers and drops every newer one. The exit's SURB ring always holds the newest SURBs — exactly the openers just discarded — so once the opener cache overflows, every reply becomes undecryptable, independent of pop order and buffer ratio. Fix: give the inner opener cache EvictionPolicy::lru(). On this write-only workload LRU evicts by insertion order — sheds the oldest, keeps the newest — a circular buffer that mirrors the SURB ring. Patch-bumps the crate to 6.3.1.
• #8422 (Sep 15) — fix(session): datagram-aware UDP copy loop end to end. The Gnosis VPN WireGuard-over-Session download collapse fix. Root cause (hoprnet#8421): the session copy loop coalesces several return-path UDP datagrams into one oversized session write under backpressure — before the segmenter runs — so the datagram boundaries are lost and cannot be recovered. hoprnet#8358 (one frame per write) is necessary but not sufficient on its own. Forward-port of #8358 to master + datagram-aware copy loop, wired end to end. transfer_session_datagram is re-exported through the transport chain and used by both UDP session bridges. TCP bridges keep the byte-stream fast path.
• #8424 (Sep 17) — see above.
• #8426 (Sep 17) — see above.
• #8428 (Sep 16) — fix(logging): demote routine SURB expiry evictions and unbalanced-session notice to debug. Log-level hygiene.
• #8392 (Sep 16) — feat(session): gate organic SURB production on the balancer target. SURB production only runs when the balancer has signalled it wants traffic.
• #8398 (Sep 15) — feat(session): drain buffered SURBs after an Exit-side close when they cover the funded cycle. Survivability: SURBs that cover a funded cycle get drained instead of dropped on close.
• #8406 (Sep 16) — chore(renovate): run on numeric release branches. Renovate now processes release/<major>.<minor> branches in addition to the default branch. The regex /^release\/\d+\.\d+$/ matches the scheme produced by the release-promotion workflow and deliberately excludes non-numeric legacy branches and hotfix/patch/nested suffixes.
• #8411/#8412/#8413 (Sep 16) — see PIX Exit telemetry stack above.
• #8430 (Sep 17) — refactor(session)!: drop pix_ssa_quota from session client config. Removes pix_ssa_quota from SessionClientConfig, HoprSessionClientConfig, and HoprSessionClientExplicitPathConfig. Capability::UsePIX is now the whole per-Session PIX switch. The reason: PIX dimensions were never a per-Session choice — new_session builds what it announces from the node's installed SsaShareGenerator; pix_ssa_quota was only compared against that value and then discarded. Exactly one value was ever accepted — the node's own — so the field carried a single bit of information (is_some()) while presenting itself as a dial.

The PIX/transport cluster as a whole: HOPR is making PIX (Payment-In-channel eXchange) operable at the supervisor level. The previous two weeks added the SURB protocol-version boundary (#8365) and the relayer-diversity diagnostics (#8368). This week adds observability for PIX operation — bounded node-level aggregates with no PII, gate-pressure episodes instead of refused-packet counters, and cycle-by-cycle recovery coverage — so an operator can actually answer the question "is the PIX Exit doing what it's supposed to?". This is the kind of work that turns a research-quality protocol into a production system.

Katzenpost: Dirauth Hardening Sweep + hpqc v0.0.87/v0.0.88/v0.0.89 Adoption

Katzenpost shipped ~15 commits Sep 14–17 that together form the most consequential dirauth hardening pass Katzenpost has shipped.

#1138 (Sep 17) — Review the Voting Directory Authority (the og-clean PR)

Reviews the voting directory authority (the "og" dirauth) and fixes what turned up.

The PR has 444 lines of changes. The headline:

• Reject bad input instead of panicking: Addresses, short descriptor identity keys.
• Guard the shared-random and certificate paths: set-commit, cert epoch binding, vote-as-cert, reveal bounds, authenticator AD.
• Give the PKI wire message a real size ceiling that covers the inter-authority certificate, derived from the configured schemes and topology, and wire it into clients.
• Connections: recover per-conn panics, cap concurrent and per-peer conns, log and drop unknown peers, bound the first command and keepalive writes, drain accepted conns on shutdown.
• Persistent inter-authority connections stay opt-in, default off.

Adds a scheme matrix and per-fix regression tests. Verified on a full mixnet and a mixed patched/unpatched authority quorum.

This is the kind of code that doesn't generate a release note per-line; it generates a "we audited our own dirauth and here's what was wrong" PR. The size ceiling fix in particular is the kind of bug that lives in the protocol spec until a heterogeneous authority set is actually deployed — the assumption that every authority agrees on the PKI scheme was unenforced.

hpqc v0.0.87 → v0.0.88 → v0.0.89 Adoption (Sep 14–17)

hpqc is Katzenpost's hybrid post-quantum crypto library. This week Katzenpost adopts three consecutive releases of hpqc that together implement degenerate-key hardening.

The high-level pattern: hpqc's NIKE/KEM primitives now reject or neutralize degenerate peer input instead of panicking or silently using it. Specifically: - mkem Encapsulate and EnvelopeReply now return an error (was: panic on degenerate recipient key). - Scheme.Blind returns nil (was: panic on degenerate group element). - DeriveSecret and the in-place Blind leave an all-zero result the caller must reject (was: attacker-predictable shared secret from a low-order point).

The Katzenpost PRs that adopt this hardening:

• #1136 (Sep 14, "adopt hpqc's degenerate-key hardening") — bump hpqc to v0.0.87, thread the new error return through every mkem Encapsulate and EnvelopeReply call site; a degenerate recipient now fails the operation. Reject an all-zero shared secret in sphinx packet creation and unwrap paths (util.CtIsZero), per the hpqc DeriveSecret contract. Reject a nil Scheme.Blind result and an all-zero in-place Blind result, so a degenerate group element cannot propagate through the chain.
• Followed by ~9 commits Sep 14: sphinx: reject a degenerate shared secret, sphinx: reject a nil blinded key, sphinx: reject a degenerate blinded key from the in-place Blind, adapt to hpqc's mkem error returns, go.sum: pin hpqc v0.0.87, Merge origin/main into adopt-hpqc-degenerate-key-hardening, etc.
• Sep 17: #1154 — Bump hpqc v0.0.88 — breaking changes to hpqc's BACAP API now require Katzenpost to change its BACAP call sites.
• Sep 17: version bump to hpqc v0.0.89 — additional BACAP-related call-site fixes (test fixture validity check, error-return handling).

The pattern is exactly the same as the Sep 11 katzenpost PRs that adopted the prior hpqc version, but bigger and more consequential. The degenerate-key class — low-order X25519/X448 points, CTIDH base curve E0 — is exactly the kind of input that an attacker can supply to crash the peer. hpqc hardening moves from "panic" to "return error" to "caller must reject"; Katzenpost adopts every step.

Other Katzenpost PRs this week

• Sep 17: authority/voting/client: close the dialed conn on a scheme lookup error — initSession dialed the peer, then returned without closing conn if the peer's configured WireKEMScheme or PKISignatureScheme name was unregistered. Every PKI client operation against a misconfigured peer (e.g. each polling interval) leaked one socket. Also: warn when a reply is rejected as oversized — deriveMaxMessageSize assumes a bounded topology since a client cannot know the real one before its first consensus fetch, so a network that outgrows that allowance otherwise fails PKI fetches with no diagnostic beyond a bare wire error. Export wire.IsOversizedMessageError to detect it.
• Sep 17: courier: reject a configured authority set that disagrees on PKI scheme — newPKIWorkerWithDefaultClient derived its PKI signature scheme (and so its wire ceiling) solely from the first-listed authority, on the unenforced assumption that every authority shares it. A heterogeneous config silently under-estimated the ceiling for whichever authority was not consulted, rejecting its legitimate traffic as oversized.
• Sep 17: authority/voting: split onCertUpload and dialAndHandshakePeer — pure extraction to bring both under the 95-line screen limit. No behavior change.
• Sep 16: authority/voting: bind uploaded vote, reveal and sig to the peer — onCertUpload verified that the certificate's declared PublicKey matches the wire-authenticated peer, but onVoteUpload, onRevealUpload and onSigUpload did not (onVoteUpload's comment wrongly claimed otherwise). An authorized but byzantine authority could therefore relay another authority's genuine vote, reveal or signature over its own connection. Apply the same identity-binding check to all three.
• Sep 16: authority/voting: wait a full keepalive interval between peer commands — the persistent authority serve loop reset the idle read deadline via RecvCommand, whose armIO caps every read at the session ReadTimeout (ResponseTimeoutSec, 30s). That clobbered the intended keepalive idle timeout (120s), so a warm connection closed 30s into an idle gap and the next keepalive (60s) never arrived, defeating the persistent-connection feature. Raise the session read timeout to the keepalive interval for the serve loop.
• Sep 16: core/wire: serialize each logical send and receive as a unit — SendCommand guarded only each individual cipher operation, so two concurrent sends on one Session could interleave a message's header encrypt, body encrypt and rekey with another's, desyncing (or reusing) the ChaChaPoly nonce stream and corrupting every subsequent frame. Hold one exclusive lock across the whole send (through the wire write) and across the whole receive.
• Sep 16: authority/voting: a missing shared-random reveal must not break consensus — the certificate embedded every commit and every reveal an authority had seen. When an authority saw a peer's vote (commit) but never its reveal, which happens when a peer goes down between the vote and reveal deadlines, the commit and reveal sets had unequal cardinality, so IsDocumentWellFormed rejected the certificate and the authority emitted none. When enough honest authorities were in that state the round produced no certificates and consensus stalled: a single non-revealing authority could break a six-authority network far above its fault threshold. Embed only the commit/reveal pairs we hold both halves for, logging and dropping a commit whose reveal we never received; as long as at least threshold authorities revealed, consensus still forms. Verify at reveal-upload time that a reveal opens its commit, so an honest certificate can never carry a signed-but-mismatched pair. Turn the commit/reveal mismatch case in getMyConsensus from a panic into an error.
• Sep 15–16: core/cert,pki: reject wrong-sized signatures before the sign scheme panics — cert.Verify and cert.AddSignature, and the descriptor upload verifiers, passed an attacker-controlled signature payload straight to the sign scheme. The hybrid "Ed25519 Sphincs+" scheme's Verify panics on a wrong-sized signature. Length-check the payload against the scheme's SignatureSize, and reject a nil descriptor signature, before calling Verify.
• Sep 15: authority/voting: pin the wire-KEM ceiling test to Ed25519 so it runs on Windows — Ed25519 Sphincs+ is not built on Windows, so the McEliece and MLKEM cases both collapsed to the flat default and the scaling assertion failed.
• Sep 15: authority/voting: close temp db and log handles so Windows cleanup can remove them — on Windows an open bbolt state.db or file-backed log keeps a lock, so t.TempDir's RemoveAll cleanup cannot delete the file and the new authority tests fail.
• Sep 15: authority/voting: default to Ed25519 on Windows (no cgo Sphincs+) — hpqc builds Sphincs+ only with cgo, which it does not do on Windows, so ByName("Ed25519 Sphincs+") is nil there.

The cluster as a whole is Katzenpost hardening its own dirauth — the panics-on-attacker-input class, the consensus-stall-on-missing-reveal class, the wire-format ceiling class, the persistent-connection-class bugs are all closed in this window. The hpqc adoption work is the input to many of those: a panic on a malformed signature used to take down a directory authority, and now it doesn't. Namenlos public mixnet is still listed as "coming next" on katzenpost.network; the project's public letter to the European Parliament ahead of Chat Control remains front-paged.

Nym v2026.18-essaouira: First Release Branch Cut Since djibouti

Merge #7161 (Sep 17 12:09:10Z) merges release/2026.18-essaouira to develop. The release notes (#7159, Sep 17) bump the version and document the changes. Nym Binaries v2026.18-essaouira is the first release-branch cut since v2026.17-djibouti (Sep 2) — 15 days.

Headline items in the cut:

• #7134 (Sep 15) — Lock-free topology. The biggest single-PR change in this release. Replaces the topology-read path's RwLock with a lock-free structure (likely an ArcSwap or atomic-pointer-based snapshot). This doesn't move microbenchmarks but matters under contention: when the LP (Loopix-style) provider streams are simultaneously updating per-node entry/exit routing info, the previous lock caused convoy effects. The PR description is sparse but the title is unambiguous.
• #7153 (Sep 14) — Residential IP research document. A complete operator-side research document for residential IP use in NymVPN: six subsections covering VPS (commercial VPS providers with residential IP ranges), BYOIP (bring-your-own-IP), ISP (consumer ISPs that allow running exit nodes), mobile (4G/5G mobile residential IPs), home (consumer home broadband), and Swiss (Switzerland-specific legal context). The _meta.json was updated twice to make this a top-level menu entry under operators/community-counsel/residential-ip. This is a real practitioner document for people who want to run a residential-exit node that won't get the IP reputation-trashed by GFW or blacklist operators.
• #7154 (Sep 15) — Additional logs when performing node lookup. Diagnostic logging for node-lookup failures.
• #7155 (Sep 15) — Fix residential IP display. Operator UI bugfix.
• #7157 (Sep 17) — Nym node ansible system maintenance and node log rotation improvements. Six fixes in one PR: replace ansible maintenance flow; create script to enable discard on host (i.e. enable fstrim or discard-on-lvm-thin); fix broken rabbit; fix deploy timeout; fix upgrade timeout; fix base role timeout. Operator-experience work: the Ansible-based node management needed a clean rewrite, especially the deploy/upgrade timeout handling.
• #7145 (Sep 14) — bugfix/cred-proxy-keys. Credential proxy key bug fixes. The cred-proxy is the bridge between Nym's zk-nym credential issuance and the LP registration path.
• #7159 (Sep 17) — Release notes for v2026.18 essaouira. The PR that ties the release together.
• #7161 (Sep 17) — Merge release/2026.18 essaouira to develop. The release cut.
• #7162 (Sep 17) — nym-node-cli improve location handling for better UX. The nym-node-cli location-flag UX is improved; comments are fixed.
• add ci to build geolocator image (Sep 17) — CI for the Geolocator container image. Geolocator is part of the Directory Contract stack from v2026.17-djibouti.
• chore: update changelog (Sep 16) — release-prep hygiene.

NymVPN F-Droid lag: from the GrapheneOS Discussion Forum (a separate signal, not an Aljaz-direct news item): F-Droid's last NymVPN Android build is 2026.11.3 from July 28 — three weeks behind GitHub. The next two stable releases (2026.12.1, 2026.12.x) are not yet on F-Droid as of Sep 18. GrapheneOS Forum recommends using Obtainium to fetch from GitHub for users who don't want to rely on Play Services. The Play Store build is more current (2026.12.3 as of Aug 28). This is an F-Droid build pipeline lag, not a NymVPN security issue — but it's a real friction point for F-Droid users running NymVPN.

I2P: Tim C Hardening Sweep + i2psnark Network-Etiquette Hygiene

I2P shipped ~15 commits Sep 13–17 split between I2P router core hardening (Tim C reports) and i2psnark tracker/announce hygiene.

Tim C hardening sweep (Sep 16, all reported by Tim C):

• Sep 16: crypto: make EdDSA sig comparison constant time — Defensive against side-channel timing attacks on signature comparison. I2P has historically used non-constant-time memcmp for this; the fix is the textbook constant-time comparison.
• Sep 16: crypto: make AES operation constant time in deprecated/unused method — Defense in depth: even though the method is deprecated/unused, making it constant-time means a future caller can't accidentally re-introduce a side-channel.
• Sep 16: Tunnels: Don't process dup fragments — A DoS-relevant fix: an attacker could supply duplicate fragment identifiers to cause redundant processing. (Reported by Tim C.)
• Sep 16: Tunnels: Limit size of fragment reassembly map — Bound the unbounded-growth class of bug. The fragment reassembly map could grow without limit if an attacker supplies many distinct fragments that never complete; this caps the map size to prevent OOM. (Reported by Tim C; fix adapted from Tim C.)
• Sep 16: i2pcontrol: Log and delay on auth failure — Anti-bruteforce: log failed authentication attempts and add a delay between them. Reported by Tim C.

i2psnark network-etiquette hardening (Sep 13–17):

• Sep 17: streaming: Mark window size option methods unused — Cleanup: mark the unused methods.
• Sep 15: i2psnark: Limit max reported peers to protect against tracker bugs — Cap the number of peers reported to a tracker in a single announce, in case a tracker has a parsing bug that overflows on large lists.
• Sep 15: i2psnark: Extend keepalive interval from 30 to 60s, only send on inactivity — Network etiquette: don't send a keepalive every 30s if the connection is active; send it every 60s only when there's been inactivity. Reduces idle-bandwidth.
• Sep 14: Router: Update cert and re-enable new reseed — Update the bundled router certificate and re-enable the new reseed mechanism (i.e. the trusted reseed hosts that I2P clients use to bootstrap their router info from).
• Sep 13: i2psnark: Add all trackers to magnet links — Generate magnet links with the full tracker list, not just the primary tracker.
• Sep 13: i2psnark: Set next announce based on last response time, not request time — Tracker etiquette: schedule the next announce based on when the last response arrived, not when the last request was sent. Failures get retried faster because the response timing reflects when the tracker was actually reachable.
• Sep 13: i2psnark: Change backup tracker to UDP and add to tracker list — The backup tracker is moved from HTTP to UDP, and added as a peer in the announce list.

Transport WIP (Sep 14):

• Transport: Partial impl for force-ipv6 for docker bridge (WIP) — WIP: tested only to not break IPv6; untested on real docker bridge; more to follow.
• Transport: Add explicit force-ipv6 enum (WIP) + Transport: Add explicit force-ipv6 case for clarity + Transport: Stub out NATPMP enums (WIP) — WIP plumbing for IPv6 force mode and NAT-PMP enum support.

No I2P core release this week. I2P 2.13.0 (Jul 24) remains current. I2P 2.14.0 with the Hybrid MLKEM SSU2 release is still targeted for October 2026.

Chat Control 2.0: Negotiations Resume at Council on Sep 12

EU Tech Loop reported Sep 9 that on September 12, European Member States would have to finalize their positions on the proposed regulation to force client-side scanning of CSAM in messaging apps. As of Sep 18:

• The Danish Presidency of the Council is pushing for CSAM scanning.
• 6 Member States publicly opposed: Austria, Belgium, Czech Republic, Finland, Netherlands, Poland.
• Germany "undecided" under the Merz-led conservative coalition (previously a strong opponent under the SPD-led government).
• Estonia, Greece, Luxembourg, Romania, Slovenia "undecided".
• Estonia's former CIO Luukas Ilves has publicly questioned Estonia's stance ("Estonia has always been a fervent proponent of end-to-end encryption...").
• Multiparty opposition in EP: Greens/EFA VOLT ("protecting children online is possible without mass surveillance"); Patriots for Europe incl. Czech MEP Filip Turek; Finnish EPP MEP Aura Salla.

No final Council position was reported as of Sep 18. The Council now has until ~October 9, 2026 to accept or reject the Parliament's amendments (the second-reading procedure's 3-month clock). The amendments that Parliament adopted on July 9 explicitly protect end-to-end encrypted services (369 and 362 votes, both cleared the 361-vote threshold) — but the Council could weaken or remove those amendments.

The mixnet-community response: Katzenpost's public letter to the European Parliament remains front-paged on katzenpost.network ("Chat Control, Thursday: you are about to outlaw what you paid us to build"). The Privacy Guides Nym analysis thread ("Analysis of Nym VPN and its 'guaranteed' privacy") continues to attract critical replies; update 10/09/26 was the prior week's state.

Tor Network: 9,330 Relays — Post-EOL Equilibrium

The relay count trajectory over the post-0.4.8-EOL period:

The count has stabilized at ~9,330. This is essentially the same as last week's 9,331 (Sep 8) and confirms the network has found its post-0.4.8-EOL equilibrium. The exit count holds at ~3,140.

Why this matters: the post-EOL drain was a one-time event, not a continuing decline. The network absorbed the cut without drama, just shrank to the operators who upgraded plus the cumulative effect of Hetzner de-peering (Dingledine DEF CON 34 estimate: ~20% of network's relay-exit infrastructure). The 2-week browser cadence + Tor VPN Beta's Arti build are unlikely to drive an immediate relay surge but should draw modest new-relay donations over time.

Research Scan: Sep 12–18

ePrint keyword searches for mixnet / onion routing / anonymous communication returned no fresh first-line mixnet papers in the Sep 12–18 window. The active anchors remain:

• DumboMix (ePrint 2026/1699, async anonymous broadcast with G.O.D. via Shamir-share MPC, O(1) multiplicative depth)
• De-SyRIS (ePrint 2026/1723, decentralized Sybil-resistant identity without trusted issuer)
• Proof-of-Uniqueness (ePrint 2026/1725, threshold-OPRF Sybil-resistant pseudonymous DIDs)
• Cao & Green reputation-framing attacks on Nym (ePrint 2026/101)
• Verifiable SelfMix (ePrint 2026/1617)
• QuMixnet (post-quantum mixnet protocol)
• MOCHA (ePrint 2025/861, IH&MMSEC 2025, Loopix client-anonymity measurement)
• Outfox (ACM SIGCOMM 2025, simplified Sphinx for PQ)
• Anonymous Communication on Expander Networks (ePrint 2026/1404, approved 2026-07-13) — Tufts/Brown result: differentially-private and anonymous protocols in polylog rounds with polylog server load over expander graphs.

The pattern holds: shipping work (Tor WebAssembly-at-Safer fixes, HOPR 4.1.x regression + pool arbiter + PIX telemetry, Katzenpost dirauth hardening sweep, Nym essaouira lock-free topology, I2P constant-time + DoS-bounded) dominates over new theory. The Q3 2026 mixnet research agenda is consolidation of existing primitives under load and policy pressure — which is what this week's banner story is.

Out-of-Scene but Adjacent

• Privacy Guides Nym analysis — the independent researcher vs. NymVPN thread remains active through Sep 18. Last week's update 10/09/26 added multiple critical replies; Nym team's silence is the recurring pattern. Not a technical bug, but a brand-trust pattern that mixes into the Nym ecosystem coverage.
• NymVPN F-Droid lag — F-Droid's NymVPN Android build is 3+ weeks behind GitHub as of Sep 18. Last F-Droid build is 2026.11.3 from July 28. Play Store is more current. GrapheneOS Forum recommends Obtainium for users who don't want Play Services.
• EU Chat Control — Sep 12 was the scheduled Council position-finalize deadline; no deal as of Sep 18. The ~3-month / ~Oct 9 deadline from the July EP second-reading procedure is the next material date. The Katzenpost letter remains front-paged.

Evidence at a Glance

Primary sources

• MOCHA: ePrint 2025/861