-
On September 23, 2026, the Tor Project released emergency updates, meant to patch the software from serious security holes.
-
The ten tracked vulnerabilities include memory flaws, issues with anonymity, and an attack that is meant to bring down the onion services.
-
The Tor Project is keeping technical specifics confidential for a week in order to prevent unauthorized use of the vulnerabilities.
Some critical security flaws hit the entire Tor network. To fix the issues, on September 23, the Tor Project released an emergency version 0.4.9.13 update. This update reached every part of the Tor Network relays, client applications, and onion services.
The project urged everyone running Tor software to upgrade immediately. That’s a strong signal, since Tor developers don’t usually sound alarms this loudly.
What Triggered the Fixes
Tor developers credited the discovery to what they call the “LLM report firehose.” That is what they call the storm of security alerts caused by AI analyzing the code for holes. This is not the first time they have done this. AI-assisted scanning has become a steady source of new findings for the project this year, and this release marks another wave from that pipeline.
This was also Tor’s second emergency release in just fifteen days. An earlier update, version 0.4.9.12, came out September 8. Fixes such as this are unusual for a project like Tor that normally moves at a slow and deliberate pace.
Ten Vulnerabilities, Limited Details
The release notes cover 16 categories of bug fixes in total. Ten of those carry official TROVE IDs, the Tor Project’s internal system for tracking vulnerabilities. Think of TROVE as Tor’s own version of the CVE system used across the software industry.
Here’s the catch: the notes are short on specifics. The Tor Project said full technical write-ups, filed as public tickets on GitLab, won’t appear for about another week. That’s a deliberate move.
If they publish exploit details too early, it would provide an attack roadmap for attackers even before most of the network has gotten the patch. Nevertheless, the issue is clear enough to worry security-minded users.
Memory Bugs that could Crash Relays
A first group of vulnerabilities involves a problem related to memory corruption on relays. Servers managed by volunteers and used for routing traffic in the Tor network. From a theoretical standpoint, such a bug may allow an attacker to crash or even compromise a relay.
The project has not yet verified whether these bugs can enable remote code execution. But memory corruption flaws are exactly the kind of bug that sometimes escalates into full device takeover.
Windows users have also faced multiple security issues involving memory and core system components, as covered in Three new Windows attacks target memory, defender, and driver security. That’s likely why Tor chose to stay quiet on the technical specifics for now.
A separate fix addresses a “use-after-free” bug in how Tor handles connections. This issue happens when software repeatedly uses the same piece of memory it already freed. This either crashes the program or opens the door to bigger attacks.
A Vulnerability that Puts Anonymity at Risk
Two of the fixes strike at the heart of what Tor promises: anonymity. One of the flaws could let a malicious .onion site tie together browsing sessions that are supposed to stay private and separate, which defeats the main reason people use Tor in the first place.
There’s another problem, too, with something known as stream isolation. This feature is supposed to make sure that your different browsing activities can’t be connected back to you.
But the release notes say a malicious onion site or a hacked HSDir relay (that’s a server helping route traffic to onion services) can take advantage of this flaw. The result? Someone could tie together your activity across different sessions. For journalists, activists, or anyone who really depends on Tor for anonymity, that’s easily the most worrying bug here.
Onion Services Open to Flooding Attacks
There’s also a fix for a denial-of-service problem targeting onion services those .onion sites that live only inside the Tor network. Attackers can flood these sites with continuous connection attempts, which can force them to go offline.
This update is crucial for .onion sites, especially if there’s been an unusual spike, so site operators should make it a priority.
What’s Next for Tor Browser Users
Now, it becomes complicated for common users. The current stable Tor Browser release, version 15.0.23, rolled out on September 15, more than a week before the fixes were ready. So odds are, it doesn’t have these patches yet.
Tor Browser users must stay alert for the coming releases and update the browser immediately. There’s currently no evidence that anyone has exploited this security. But that may change overnight if the detailed breakdowns go public next week.
Relay operators and onion service administrators have the most urgent reason to act. This should not be put off until the technical tickets are done. Upgrading right now is more sensible, and many Linux distributions have started distributing this updated version through their distribution update paths.
