Yet another Android leak enabling malicious apps to send traffic outside the VPN tunnel has recently been discovered.
Read more here: https://mullvad.net/blog/another-way-to-leak-traffic-on-android-has-been-discovered
9/11/2026, 12 engagements
Mullvad VPN
A fast, trustworthy, and easy-to-use VPN is a good first step toward reclaiming your privacy. Just €5/month. For your right to privacy.
For support, contact us via email: support at mullvadvpn dot net
Bridged to Bluesky via https://bsky.app/profile/mullvadnet.mastodon.online.ap.brid.gy
On November 2nd 2026 our public Encrypted DNS servers will be shut down.
This does not impact customers of our VPN if DNS content blockers are used.
Read more here: https://mullvad.net/blog/shutting-down-our-public-encrypted-dns-servers-and-sponsoring-quad9-instead
9/7/2026, 8 engagements
We’ve updated the Multihop feature with different modes, to make it more flexible and easier to use.
Read more here: https://mullvad.net/blog/introducing-multihop-modes
8/24/2026, 20 engagements
We would like to address the recent controversy about one of the owners of Mullvad making a donation to a Swedish political party.
7/21/2026, 25 engagements
“The instrument (the telescreen, it was called) could be dimmed, but there was no way of shutting it off completely.” George Orwell, Nineteen Eighty-Four.
Two months left before the UK government requires all content on British citizens' mobile devices to be scanned.
Piccadilly Circus, London: Nineteen Eighty-Four was supposed to be a warning, not an instruction manual.
7/16/2026, 6 engagements
London Underground. VPN restrictions are still on the table in the UK. Much of it depends on the next Prime Minister. Hopefully, that question mark won't turn into a full stop.
7/13/2026, 12 engagements
Piccadilly Circus. The London Councils didn’t like our campaign against the upcoming state spyware in the UK. So, first the word ”government” was blacked out. Then the whole message was scrapped. On the other side of the road, though: alive and kicking.
7/10/2026, 13 engagements
Chat Control 1 is back. By a margin of 314-276, the EU Parliament voted to reject the legislation. However, since it was an urgent procedure, an absolute majority of 361 votes was required. As a result, the majority lost and Chat Control 1 passed. The urgent procedure was a dirty tactic by the Council and parts of the Parliament – it’s a procedure not meant to be used for legislation already rejected by the Parliament.
7/9/2026, 22 engagements
On Thursday, the European Parliament votes on Chat Control 1 (the voluntary scanning, not the mandatory scanning, called Chat Control 2). Again.
The Parliament has already voted against Chat Control 1. Two times. But the Council of Ministers and the Parliament President refuse to accept it.
The President of the European Parliament has sided with the Council against her own chamber. For context, this is the EP President, Roberta Metsola:
7/7/2026, 5 engagements
Piccadilly Circus, London. Keir Starmer now demands state spyware on every mobile device, always watching the screen, scanning everything, looking for things the government disapproves of.
6/12/2026, 24 engagements
Some politicians in the UK think it is a good idea to introduce identity verification for using VPN services.
It could be that these politicians do not understand what they are proposing. The alternative, that they do understand, would be even worse.
1/2
6/6/2026, 17 engagements
So-called age verification for social media is spreading across the world, framed as an effort to create a safer internet for children. In reality, age verification lays the foundation for a fully controlled internet.
The age verification rush must be slowed down, and politicians need to recognize the consequences of different types of legislation and systems.
Read more on https://mullvad.net/blog/age-verification-for-social-media-the-beginning-of-the-end-for-a-free-internet
6/2/2026, 17 engagements
The EU age verification app is presented as “completely anonymous”. The idea is to use Zero-Knowledge Proof (ZKP) cryptography.
But currently, the EU app does not have ZKP functionality. More importantly, the app is designed to always function without ZKP. Even if fully developed ZKP technology could be implemented in the future, it would remain an optional feature that countries may choose to disable and that the EU could remove at any time.
More details on https://mullvad.net/blog/age-verification-for-social-media-the-beginning-of-the-end-for-a-free-internet
6/1/2026, 7 engagements
Our Android app has for the second time passed MASA, a standardized security assessment, conducted by Leviathan Security Group.
Read more: https://mullvad.net/blog/2026-security-assessment-of-our-android-app
6/1/2026, 1 engagement
On Friday the 15th of May, we became aware of a fingerprinting issue affecting Mullvad users.
We have a method which changes this behaviour currently being tested, with plans to begin rolling it out to our VPN servers in the coming weeks.
Read more here: https://mullvad.net/blog/exit-ip-fingerprinting-between-vpn-servers
5/20/2026, 1 engagement
A new VPN leak that allows any app to leak traffic outside the VPN tunnel has recently been discovered by Yusuf (https://x.com/cybaqkebm)
Read more here: https://mullvad.net/blog/any-app-on-recent-android-versions-can-leak-certain-traffic
5/12/2026, 1 engagement
It’s absurd that American authorities can purchase personal data – that they’re not allowed to gather themselves without a warrant – directly from data brokers. This violates the Fourth Amendment, and it’s time to close the data broker loophole.
Today, the Surveillance Accountability Act was introduced. It requires warrants based on probable cause for all government surveillance and data access.
You can read more about it here: https://www.surveillanceaccountability.com/
4/23/2026, 1 engagement
Apple's networking stack is preventing the iOS app from being as secure as possible, we have now secured our app to mitigate this despite the rough edges around the update procedure.
Read more here: https://mullvad.net/blog/force-all-app-traffic-into-the-tunnel
4/22/2026, 1 engagement
This is Senate House in London. When George Orwell wrote 1984, the building served as the model for the headquarters of the Ministry of Truth (the propaganda ministry). The Ministry of Truth decided what was true, for example that 2+2=5. It was responsible for censorship and rewriting history, and it banned the word “free” in the sense of freedom.
3/27/2026, 2 engagements
Chat Control 1 is dead. Let’s end Chat Control 2.
Members of The European Parliament: stand firm in your position – no mass surveillance whatsoever!
3/26/2026, 5 engagements
Starting with 16.0a1 alpha release, Mullvad Browser Alpha is based on the Firefox Rapid Release channel rather than the Extended Support Release (ESR). The alpha release is now available on Linux ARM.
Read more here: https://mullvad.net/blog/mullvad-browser-alpha-moves-to-firefox-rapid-release-and-adds-linux-arm-support
The only way we want our ads to come down. When people take them home.
a) Keep them. b) Send them to Ashton Kutcher. c) Put them outside 10 Downing Street.
Mass surveillance and censorship are escalating in many countries right now. There is a global attack on secure encrypted communication. Often, authorities, politicians, and tech companies work together to push for new laws. One example: when Ashton Kutcher (yes, the actor), through his tech company Thorn, tried to introduce total surveillance of all EU citizens through undemocratic and corrupt methods.
3/10/2026, 2 engagements
Our WireGuard implementation, GotaTun was recently audited by Assured Security Consultants. Two identified low severity issues were fixed prior to the completion of the audit.
No major vulnerabilities were found.
Read more here: https://mullvad.net/blog/a-security-audit-of-gotatun-is-now-available
3/6/2026, 1 engagement
That's the spirit.
Hear, hear. NO MORE AND THEN!
What do you do when you get banned on British TV?
3/2/2026, 1 engagement
The Mullvad night shift at work. Stay tuned.
Amazing, this one is up. For now.
2/27/2026, 1 engagement
Today, the final negotiations on Chat Control 2.0 begin.
We hope the European Parliament stands firm against any wording that paves the way for mass surveillance and censorship. Cyprus, currently holding the Presidency of the Council of the EU, aims to conclude the negotiations by June.
A reminder of the corrupt backstory behind the Chat Control proposal and the involvement of Ashton Kutcher and his company Thorn: https://mullvad.net/why-privacy-matters/going-dark
Today, we hit the streets with a major "And Then?" campaign in the UK, despite having faced strong opposition.
First, our TV ad "And Then?" was banned on British television.
And then, the outdoor ad campaign meant to criticise the TV ban was largely halted.
Here, you can watch the banned ads and explore the entire campaign.
https://mullvad.net/and-then/uk
God save the Mullvad ads. This one got banned too, by The City of London.
2/21/2026, 2 engagements
Mullvad was banned on British TV. And then? And then this underground ad got banned by the government body Transport For London.
The argument was clear: you cannot encourage people to engage with a banned TV commercial.
We have added new currencies to our list of supported credit card payment methods!
Read more here: https://mullvad.net/blog/addition-of-new-supported-currencies
Late last year X41 D‑Sec GmbH performed a white‑box source‑code audit of the Mullvad payment and account API and its supporting backend services.
Read more about the audit here: https://mullvad.net/blog/2026/1/21/new-security-audit-of-account-and-payment-services
Read the report here: https://www.x41-dsec.de/static/reports/X41-Mullvad-Audit-Public-Report-2026-01-20.pdf
2025 has been a year of campaigns, audits and improvements to our suite of obfuscation methods.
Read about some of the highlights here:
The war on privacy and encryption goes on. This time in the UK. Under the “Children’s Wellbeing and Schools Bill”, lawmakers now want client-side scanning on every phone and tablet.
The lawmakers write: “Any relevant device supplied for use in the UK must have installed tamper-proof system software which is highly effective at preventing the recording, transmitting (by any means, including livestreaming) and viewing of CSAM using that device.”
1/2
12/19/2025, 4 engagements
GotaTun is a WireGuard® implementation written in Rust aimed at being fast, efficient and reliable. Now available to all Android users, we aim to ship it to the remaining platforms next year.
Read more here: https://mullvad.net/blog/announcing-gotatun-the-future-of-wireguard-at-mullvad-vpn
The European Commission lost the Chat Control 2.0 battle over access to end-to-end encrypted data. By the summer 2026, they will be back with their next attempt: Going Dark. This time some EU member states want to include VPN services.
The Going Dark initiative, or ProtectEU as the Commission now calls it, wants to “enable law enforcement authorities to access encrypted data in a lawful manner”. This is a Chat Control 3.0 attempt.
12/18/2025, 2 engagements
This is the final reminder that we are fully removing support for OpenVPN on January 15th 2026, in a month's time.
Read more here: https://mullvad.net/blog/final-reminder-for-openvpn-removal
12/15/2025, 1 engagement
Our latest desktop release, 2025.14, is removing support for OpenVPN entirely.
If you rely on OpenVPN you should stay on 2025.13 until the OpenVPN servers are shut down in January 2026.
Read more here: https://mullvad.net/blog/removing-openvpn-from-the-mullvad-vpn-app
Today, the trilogue negotiations start. Stop Chat Control.
12/9/2025, 2 engagements