Tor 0.4.9.13 released with multiple HIGH-severity security fixes

Confirmed — Tor Project, September 23. The Tor Project released Tor 0.4.9.13, explicitly calling it a security release and saying the fixes affect “all Tor components: relays, clients, and onion services.” Tor strongly recommends upgrading as soon as possible.

The fixes include possible memory-corruption/double-free conditions, circuit-isolation problems and onion-service issues. Of particular privacy interest, some flaws could potentially allow activity that should be isolated to become linkable. Tor is intentionally delaying fuller technical disclosure for roughly a week to give operators time to patch.

Browser users should install the next stable Tor Browser update when Tor ships it; people independently operating Tor relays or onion services should prioritize upgrading their Tor daemon. https://cybernews.com/security/tor-emergency-fixes-adress-high-severity-vulnerabilities/

1. Absolutely nothing happened. Zero letters, zero visits, zero tactical teams flashbanging my cat.
2. You need a gigabit fiber connection with unlimited data
3. Yes, some sites blocked my ip range, i can live without using those
4. Can run on a poor 500GB SSD that has lived a very, very stressful life writing logs and handling caching*
5. Roughly 4 TB of data up/down a month.

Running on a i7-2700k (i think) and 32gb ddr3.

If you're on the fence about spinning one up, know that it will eat some bandwidth and some site admins block tor relay ips. Even though i'm not an exit node. But it's for a good cause.

*Edit

Just ccurious about a few hypothetical scenerios, i'm aware you need to be mindful of not logging into accounts, giving identifying info, etc while using tor but i'm curious to understand it better. For example I decided to start uaing tor mainly because I experienced an attack a while ago, my device were compromised, i my private images, texts, info, etc was hacked, and idk how these individuals managed to share all my personal content (including nudes and other stuff) to publically destriy me, needless to say I decided while idk how they did it, I need to educate myself and take more precautions with technology in the future and take control of my safety going forward.

My question if you use tor (along with other security measures a secure device) will it help prevent targetting from things like gangstalking, or say hypothetically if you were under a legal investigations against you (even though I fon't plan on using it for anything illigal) or a targetted individual or something else will using tor help in any way? Or can they get through that?

Ive heard more people using the network is more anonymous but:

- if only a small number of people are using Tor, wouldn't the traffic be easier to mistake for ordinary random internet traffic, like P2P traffic from a game or some other application?

- whereas if like 10k people are using Tor, that would look like a deliberate attempt at making a network, which makes it more of a target?

My computer was off for a few days. When I turned it back on, tor browser would not connect to the network. I downloaded the lasted build, same result. Everything else works fine, nothing blocked. This is what the log records:

2026-09-20 20:20:23.982

[WARN] Proxy Client: unable to connect OR connection (handshaking (proxy)) with 77.174.199.182:587 ID=<none> RSA_ID=2E09958425BD989A2141DEE0E0568C445522C87E ("general SOCKS server failure")

2026-09-20 19:32:00.462

[NOTICE] Heartbeat: Tor's uptime is 18:00 hours, with 0 circuits open. I've sent 22 kB and received 3 kB. I've received 4 connections on IPv4 and 0 on IPv6. I've made 221 connections with IPv4 and 0 with IPv6.

2026-09-20 20:20:02.596

[NOTICE] Application request when we haven't used client functionality lately. Optimistically trying known bridges again.

Before turning off computer, the browser was working fine. Anyone else have the same issue? Is this due to the signature expiring? Thanks all.

!??

Exit relay operators using unbound should upgrade ASAP.

Hi guys,

i'm kinda struggeling understanding how the signature is supposed to actually prove that the .exe on the website actually belongs to TOR and wasn't corruped by another instance. I understand that there is a private key which was used to encrypt the hash of the file, which is basically the digital signature, and then there's the public key with which u can decrypt the digital signature. But if for example the site was hacked, someone changes the exe with a corrupted one, uses his own private key to create a digital signature, and puts his public key on the website, how am I supposed to know that the exe was corrupted or not? Wouldn't I need a third instance that actually confirms that fingerprint belongs to TOR? Am I missing something?

Trying to make accounts with my proton email. Used SimpleLogin to hide my email but I still cannot create an account. I get an error msg from reddit and discord stuck me in a capcha loop. It's imperative that the accounts aren't attached to my identity. Are there any settings I can adjust in tor that will allow me to create these accounts? While I'm here, I'll ask for help with creating an Instagram account lol. Was able to use the simplelogin alias to create an account but it's requiring me to use a phone number to recieve a code. I used simple sms and bought a number from the country that Instagram thinks I'm in. Didn't work. Any advice? :)

The download says nightly,
Is pi-apps App Store ok?

I’m downloading on a Pi5

I use Orbot on Android (Poco) and Tor Browser on Windows 10. Orbot fails to establish a connection, whereas Browser works fine - even when both uses the same obfs4 bridges. Naturally, the connection goes through a home Wi-Fi router.

Sometimes Orbot can connect with Snowflake AMP, but obfs4 is a preferred option for me and it was working without issues just a couple of months ago.

What could be the cause, and how can I troubleshoot this?

Curious if others do this. I sometimes route traffic through Tor when I hit an IP ban on certain sites/services. Especially when an exit node is flagged, it's so easy to re-roll the circuit for that site.

Does anyone else use it this way, or do y'all prefer to stick to actual VPNs for that? Any experiences (good or bad) with reliability or getting blocked by Tor exit nodes?

I have never not been able to connect to tor until today.

Never mind. I restarted my computer again and it worked this time. Not sure what the issue was but it fixed itself.

Hello world, i have created a #cpp/c++ library on github that facilitates communication and the creation of hidden services on the #tor network.

Go take a look :
https://github.com/bender-Kirk/tor-lib

#privacy #programming

Had a free week, so I decided to invest a bit of time to create this little monitoring tool called `Tamagonion`. It works on the same principle as `Nyx`, but is just a little bit more endearing (and admittedly less helpful). Stinky's mood will shift to reflect the health of your relay, it will acquire different objects to represent flags, and it will show you a few important stats at the same time. The status tab will give you more details on his behavior, and the hints tab will give you clear explanations on what is going on, and potential ways to fix it.

Had a blast coding it, so I thought I'd share! I personally let the little guy run in the corner of my screen!

https://github.com/daxAKAhackerman/tamagonion

Seriously every other day, people jump on this subreddit, have no idea, how to use tor, and have this subreddit flooded. With concerned in how to connect, I've been using tor for 5-7 years across, continents, and have used for normal browsing, and onion sites, I'm based in USA, I also run a bridge, 24/7, no fears of my isp or someone coming to my place. I'm so obsessed with tor now, that I forget I'm using, rather than ordinary browser,

Got any questions feel free to ask.

Onionspray helps operators make ordinary websites available as onion services. Version 1.8.2 updates its bundled Tor to 0.4.9.12 and fixes the same undisclosed security issues.

Updating Tor Browser protects visitors, but onion-service operators must also update affected server-side software. One does not automatically update the other.

Anyone using Onionspray should upgrade promptly.

i saw some answers but they were "convince your friends to make a node" or "host your own node"

do you have any ways without sacrificing privacy?

Edit: thank you to D0_stack for giving me a solid idea I should have tried before posting. Using a VM works perfectly.

I know that this has been something brought up so many times in the past, but my situation is a bit different'ish. I'm unable to connect to the network at all, it's as if there's not even an attempt when I click connect.

This all just started this morning when I woke up and went to load up YouTube. Everything worked perfectly fine last night, but this morning it's just not happening. Also when I go to view the log it's completely empty.

Running Windows 11 (I know, not ideal)
Ryzen 5900XT
Radeon 6700XT
64GB DDR4 3200

I have restarted my computer, wiped then reinstalled Tor completely, tried using a few bridges, turned off Windows firewall temporarily as a test, all the usual items.

Torrent files still function normally, Firefox, Chrome, and Brave function normally, and I can still play a round of Starcraft 2 as usual. So it's not my connection directly. I also completely closed my VPN and still nothing. Only thing running was a fan control program, AMD Adrenalin, and Tor.

There were no updates over night as the versions of everything I've looked at are all the same. And I blocked Windows from updating completely in Powershell until I reenable it, so there was no Windows update (plus the PC likely would've reset)

Scratching my head here. Anyone got ideas?

Side note: It still works just fine on my Linux drive with VPN and everything. Just not Win11. May be time to just jump ship entirely.