6.4.145

v2.35.2

What's Changed Remove .exe on targets before appending .runtime_deps by @notvictorl in #5372 symbolizer: Temporarily increase llvm-symbolizer cache…

The RAR Mystery: Breaking RAR4 and RAR5 Encryption

RAR encryption has an unusual reputation: in more than twenty years there has been no practical attack against the cipher, no implementation flaw…

New Alpha Release: Tor Browser 16.0a9

Tor Browser 16.0a9 is now available from the Tor Browser download page and also from our distribution directory.

New Release: Tails 7.10

New features New shutdown procedure Tails now uses the standard shutdown procedure from GNOME.

Tails 7.10

New features New shutdown procedure Tails now uses the standard shutdown procedure from GNOME.

Release v1.171.0

1.171.0 - 2026-07-22 ### Added Added support for the OpenTofu .tofu file extension. Because OpenTofu uses the same HCL grammar as Terraform, .

v0.388.0

What's Changed Type GitHub release metadata by @JamieMagee in #15597 Make GitCommitChecker strongly typed by @JamieMagee in #15598 Retry corepack…

An AI agent broke into Hugging Face. Five days later, OpenAI said it was theirs

On 16 July 2026, Hugging Face disclosed that an autonomous AI agent had been inside part of its production infrastructure.

v2.35.1

What's Changed Upload Fuzzer Logs to GCS only if not in a uworker by @IvanBM18 in #5363 process: Adds logs to the timeout timers that terminate…

Wazuh v5.0.0 Beta 4

What's Changed fix: persist engine startup state for CMSync route logging by @jam300 in #37356 Fix invalid MTU value reported for Windows network…

Digital Triage and the Rules of Evidence: What Holds Up, and Where

The scene is familiar. A couple of desktops, a laptop, two or three phones, maybe a NAS or a bunch of external drives, and a limited amount of time…

New Release: Tor Browser 15.0.19

Tor Browser 15.0.19 is now available from the Tor Browser download page and also from our distribution directory.

javascript: v0.5.5

0.5.5 (2026-07-20) Bug Fixes javascript: make published dist loadable by plain Node (885e65c) javascript: make published dist loadable by plain Node…

javascript: v0.5.4

0.5.4 (2026-07-20) Features voice: instrument base + ElevenLabs adapter with LangWatch spans (#777) (2b32872) voice: instrument Gemini Live adapter…

python: v0.7.32

0.7.32 (2026-07-20) Features #660: expose context param on scenario.

Cracking Legacy ZIP Encryption: The Known-Plaintext Attack and Why It Still Sometimes Works

When someone hands you a password-protected ZIP archive, one’s immediate thought is “I need to break the password”.

ILSpy 11.0 Preview 1

WarningWe DO NOT own the domain ilspy[.]org See #3709 Download ILSpy only from GitHub Releases! This release is based on .NET 10.0.

The Long, Strange History of PDF (In)Security – And the Arrest That Made It Personal

PDF has a reputation as the boring, dependable file format – the one you reach for when you need a document to look exactly the same on every…

v0.387.0

What's Changed Type the gradle, swift, and pre_commit ecosystems by @JamieMagee in #15534 Default cooldown to 3 days when default-days is not…

javascript: v0.5.3

0.5.3 (2026-07-16) Features add Claude Code agent adapter (#687) (8d642d4) events: support LANGWATCH_PROJECT_ID via X-Project-Id header (#619)…

v2.35.0

What's Changed Use clusterfuzz_manifest.json to set ChromeBuildArchive by @notvictorl in #5351 Correct execution permission check 100 -> 0o100 by…

Two-Factor Authentication and iCloud: A Short History, and What We Fixed in Phone Breaker 11.03

Two-factor authentication is the least glamorous security feature, and probably the most important one.

6.4.144

Release v1.170.0

1.170.0 - 2026-07-15 ### Added Pro C/C++ scans now skip code inside statically-dead preprocessor branches (for example, #if 0 ... #else ... #endif).

A12 usbliter8 BootROM sigpatches

BootROM exploits are an important part of modern low-level forensic acquisition, and our Elcomsoft iOS Forensic Toolkit is no stranger to it.

ILSpy 10.1.1

WarningWe DO NOT own the domain ilspy[.]org See #3709 Download ILSpy only from GitHub Releases! This release is based on .NET 10.0.

v2.34.0

What's Changed Make chromium testcases public when bug is made public by @jonathanmetzman in #5338 Full Changelog: v2.33.14...v2.34.0

OnionHop 3.7.5

Quieter, faster obfs4 connects, and fixes browsing in TUN/VPN mode when a stale proxy was left behind.

New Release: Tor Browser 15.0.18

Tor Browser 15.0.18 is now available from the Tor Browser download page and also from our distribution directory.

v2.33.14

What's Changed Fix stale mapping and respect delete in rsync_from_disk by @PauloVLB in #5357 Skip RPATH patching on Schema v1 builds by @notvictorl…

v0.386.0

What's Changed Capture offending gem details on bundler registry metadata errors by @kbukum1 in #15512 Bundler: apply empty-checksum metadata patch…

OnionHop 3.7.4

Fixes bridges being silently blocked by per-app firewalls like Little Snitch on macOS.

OnionHop 3.7.3

A small diagnostics release: when bridges are reachable but the transport still can't connect, the log now points at the likely cause.

OnionHop 3.7.2

Makes bridge-transport failures diagnosable and stops the scanner trusting dead webtunnel bridges. Fixed Bridge scanner verifies webtunnel for real.

OnionHop 3.7.1

Adds a Copy button to saved bridges and SNI hosts, so you can rescan them without applying first. Added Copy button in the saved library.