Tor patches high-severity bugs twice in three weeks as AI-assisted reports pile up
Esta publicação ainda não foi traduzida; mostrando o original em inglês.
The Tor Project has shipped two security releases in fifteen days and says more will follow on the same schedule. Version 0.4.9.12 came out on 8 September 2026 "to address a series of high-severity security issues". Version 0.4.9.13 followed on 23 September "to again address a series of high-severity security issues". Of the second batch the announcement says: "These issues affect all entities that is clients, onion services and relays."
Why so many at once
The developers have been direct about the cause. On 3 September Tor's David Goulet told the tor-dev list to expect a release "every 2-3 weeks for the foreseeable coming month(s)", because of security issues arriving from "this new reality … where LLMs are in an echo chamber stuck in a tight loop over our C code". A week later Alexander Færøy added: "As long as we continue to receive the current amount of LLM-assisted security bugs, we will likely aim at keeping this new pace."
Put simply, people are pointing language models at Tor's source code, and the models are finding real problems faster than the old release rhythm could absorb.
What is known about the bugs
Very little, by design. The announcements carry no vulnerability identifiers, and the related tickets are made public about a week after each release. Until then users are asked to take the severity on trust and update.
Where the fixes have landed
- Tor Browser 15.0.22 (9 September) includes 0.4.9.12; 15.0.24 (29 September) includes 0.4.9.13.
- Bisq 2 v2.1.13 (15 September) is described as "an important security update which includes the latest Tor security release".
- Bisq 1 v1.10.9 (1 October) moves to Tor 0.4.9.13 and, like the two Bisq releases before it, says: "Updating to this version is required to continue trading."
- Relay operators on older versions are being told by the directory authorities that their version is obsolete.
What to do
Update Tor Browser. Then check every application that carries its own copy of Tor: wallets, peer-to-peer exchanges, messengers. They do not update when the browser does. An app that bundles the C version of Tor and was last updated in August is running code with known high-severity bugs. With releases now arriving every few weeks, an app that updates twice a year will spend most of that time behind.
Bisq's listing in this catalogue is here.
Sources: Tor Project forum — security release 0.4.9.13, Tor Project forum — security release 0.4.9.12, Tor Project forum — tor-dev: upcoming C-tor security release, Bisq 1 — release v1.10.9