• Amnezia VPN has published a three-step guide to protect self-hosted servers from a critical Linux kernel flaw
• Servers running the Xray protocol face the highest risk
• Amnezia Premium, Free, and Business users don't need to do anything

Amnezia VPN has warned people who run their own servers through its app that a critical Linux kernel flaw leaves them exposed, and those using the Xray protocol need to rebuild their setups to stay safe.

The bug, tracked as CVE-2026-98432, sits in the code Linux uses to accept new IPv4 TCP connections and has been present since Linux 4.4. The kernel's security team gave it a severity score of 9.8 out of 10.

Even the best VPN is only as secure as the server it runs on, and that's the problem here. Amnezia VPN says its Premium, Free, and Business services are unaffected because the provider has already updated and audited its own infrastructure. Self-hosted users, however, have to act themselves.

Why Xray servers are most at risk

The flaw is what's known as a race condition — a software bug that tricks an operating system into mishandling its own memory during an internet connection. It was reported by Anthropic researcher Xinyang Ge, and on October 27, Anthropic said an unreleased Claude model had written a working exploit for it.

With zero user interaction and no passwords needed, the exploit could fully take over a vulnerable server in roughly 53 minutes.

The attack targets servers using an advanced networking feature called MPTCP (Multipath TCP) — and that is where Xray comes in.

Xray is the engine behind censorship-resistant protocols like VLESS, and Amnezia rates it as high risk. Because Xray is built with a programming language called Go, it automatically enables MPTCP by default. As a result, server administrators could be leaving this vulnerability wide open in the background without ever realizing it.

NEW: Leave No Trace — A weekly newsletter on digital privacy and online surveillance. Leave No Trace investigates the companies and governments putting our digital freedom at risk — and the people fighting back.

📩 Subscribe now to get every edition delivered to your inbox every Friday, launching this September.

What self-hosted users should do

Amnezia's fix takes three steps and requires version 5.1.0.6 or later of the app.

That release adds a button to update packages on the server directly, which Amnezia says it built in response to this flaw. It follows the provider's Xray-core refresh in September and an earlier mandatory update for Premium and Free users.

In the app, go to Settings, then Servers, select your server, and remove Xray from the Protocols tab.

Next, open the Management tab, choose Update server packages, and reboot when prompted. The reboot is what loads the patched kernel.

Return to the Protocols tab and install Xray again, which now uses the patched version 26.10.31.

Your server will go offline during the reboot, and existing Xray connections will stop working, so you'll need to share access with your users again.

The update button also doesn't guarantee a fixed kernel, and on some Ubuntu versions the patch is still only in the "-proposed" testing channel. Until a future app release fixes it, any later reboot leaves the server vulnerable again until you repeat the Xray reinstall.

If you can't patch the kernel yet, Amnezia suggests a firewall rule that blocks IP options, or removing Xray and switching to the UDP-based AmneziaWG.

• IPVanish has added post-quantum encryption (PQE) in latest iOS update
• PQE protects your data against "harvest now, decrypt later" attacks
• The release notes don't yet reveal how IPVanish's PQE works

Update [November 11]: Following the publication of this article, IPVanish responded with some additional information. We made some small edits to include the provider's comments.

IPVanish has rolled out post-quantum encryption (PQE) in its iOS app, becoming the latest VPN provider to prepare for a future where quantum computers can crack today's encryption.

Version 4.33.2 of the IPVanish app landed on the App Store on Monday, and its release notes confirm in a single line that PQE has been added to the WireGuard protocol.

The move puts IPVanish alongside a growing list of best VPN providers already offering quantum-resistant protection, including NordVPN, Surfshark, ExpressVPN, and Mullvad.

What we know about IPVanish's post-quantum upgrade

Right now, the facts are limited. According to the App Store listing, PQE applies to WireGuard on iOS. The notes don't mention OpenVPN or IKEv2, and there's no word yet on Android, Windows, macOS, or IPVanish's TV apps.

Several key questions remain, including which algorithm IPVanish is using, whether the setup is hybrid or fully post-quantum, whether it's switched on by default, and when other platforms will follow.

We've contacted IPVanish with these queries, and a company spokesperson confirmed that while the latest IPVanish iOS app with PQE began rolling out on Monday, it will take 7 days for all users to receive the update. "During that seven-day rollout, we plan to add PQE to other IPVanish apps."

The company also told TechRadar that it will provide more details about the PQE implementation and all supported OSs once the rollout is completed, in roughly two weeks.

That said, the upgrade has been in the works for a while. Back in September 2025, IPVanish's Chief Commercial Officer Subbu Sthanu told TechNadu that post-quantum readiness was a major focus for its R&D team, which was exploring hybrid encryption for both WireGuard and OpenVPN.

At the time, Sthanu said the team was "building custom implementations rather than relying on off-the-shelf patches."

The rollout also caps a busy few months for the provider, which recently passed its third independent no-logs audit and continues to expand its RAM-only server network.

Hybrid or full? Why the details matter

WireGuard isn't quantum-safe out of the box, as its key exchange relies on elliptic-curve cryptography. Providers usually fix this by running a separate post-quantum handshake, typically with the NIST-standardized ML-KEM algorithm, and feeding the result into WireGuard's pre-shared key slot.

Most VPNs, including NordVPN, take a hybrid approach that layers post-quantum protection on top of classical encryption, so a flaw in the newer algorithm wouldn't leave your data exposed.

Some providers are now pushing further. In October 2026, Surfshark added ML-DSA authentication to WireGuard, claiming full post-quantum coverage of encryption, key exchange, and authentication. Without quantum-resistant authentication, a future attacker could, in theory, impersonate a VPN server. NordVPN is also working on post-quantum authentication.

Knowing where IPVanish sits on this spectrum will tell us how complete its protection really is.

NEW: Leave No Trace — A weekly newsletter on digital privacy and online surveillance. Leave No Trace investigates the companies and governments putting our digital freedom at risk — and the people fighting back.

📩 Subscribe now to get every edition delivered to your inbox every Friday, launching this September.

Why post-quantum encryption matters for you

Quantum computers aren't yet powerful enough to break modern encryption, but experts expect that moment, dubbed "Q-Day," to arrive eventually.

The risk is already here, though, as bad actors are already deploying so-called "harvest now, decrypt later" attacks to collect encrypted traffic today and store it until they gain the tools to unlock it.

For most people, this isn't cause for panic. But if you send sensitive information that needs to stay private for years, such as financial, medical, or work data, PQE adds a valuable layer of future-proofing.