security review Archives

AppWizard

September 10, 2026

Tor VPN Beta brings isolated app-by-app Tor routing to Android

The Tor Project has launched Tor VPN Beta for Android, allowing mobile applications to route traffic through the Tor network, expanding beyond web browsing. This development was driven by user demand for privacy tools to bypass internet censorship, particularly in restrictive regions. The concept originated in 2021, and after initial testing and user feedback, the beta was announced on September 9. Tor VPN creates a separate Tor circuit for each application, enhancing privacy by complicating activity correlation across apps. Users can select which applications use Tor, and the interface has been improved for easier management. The beta version 1.4.0 includes support for WebTunnel bridges to disguise Tor connections as standard encrypted traffic. Usability testing revealed issues with exit-node selection, leading to a design change that requires users to connect to Tor before choosing an exit. Tor VPN is built on the Arti implementation of the Tor protocol and the Onionmasq networking layer, ensuring stability and component sharing. The software supports reproducible builds and is available via F-Droid and APK downloads. A security review in June 2025 found no major flaws but identified some issues being addressed. Tor VPN is currently in beta and focuses on enhancing circumvention capabilities and usability rather than competing with commercial VPNs on speed. Users in censored areas are advised to configure bridges for access.

AppWizard

August 19, 2026

PixelReel Minecraft mod exposes Plex server API keys

A security vulnerability has been identified in the PixelReel mod for Minecraft, specifically in version pixelreel-1.0.0.jar and the 26.3 snapshots on CurseForge. This flaw exposes media server URLs and API keys to other players on the same multiplayer server. The mod requires users to process streams through VLC, which leads to the extraction and transmission of sensitive authentication details to Minecraft. The developer has admitted that the mod was created without a thorough security review. Users are advised to create a read-only account for use with PixelReel and to remove the mod from multiplayer environments. It is recommended that all exposed API keys be rotated, as no patch has been released to fix the vulnerability.

AppWizard

July 16, 2026

Google to open Android to third-party app stores in US on July 22

Beginning July 22, Google will allow third-party app stores in the United States to access its Play Store catalog through the Play Catalog Access Program. App listings submitted to these third-party platforms will be accessible, but downloads will still require completion via Google Play, with standard service fees applying. This initiative follows a settlement with Epic Games, which involved adjustments to a court order. Third-party app stores must pay a ,000 upfront service fee for a security review and an annual fee of ,000 to maintain access to the Play catalog. Additionally, Google has reduced its commission on app purchases from 30% to 10% and allowed external billing options as part of the settlement.

AppWizard

July 15, 2026

Android will get third-party app stores, but Canadians have to wait

Google has launched the Play Catalogue Access Program, allowing third-party Android app stores to access the Play Store's app catalogue starting July 22. Apps submitted to Google will be available on these external stores, expanding developers' reach. Downloads from third-party stores will still go through Google Play, maintaining existing service fees. Third-party stores must pay an initial service fee of ,000 for a security review and an annual fee of ,000 for ongoing access. Google has also reduced its commission from 30% to 10% following a settlement with Epic Games, allowing developers to offer alternative payment options. These changes are currently limited to the U.S. market, with a global rollout expected by September 2027.