Late last year X41 D‑Sec GmbH performed a white‑box source‑code audit of the Mullvad payment and account API and its supporting backend services.

Read more about the audit here: https://mullvad.net/blog/2026/1/21/new-security-audit-of-account-and-payment-services

Read the report here: https://www.x41-dsec.de/static/reports/X41-Mullvad-Audit-Public-Report-2026-01-20.pdf

2025 has been a year of campaigns, audits and improvements to our suite of obfuscation methods.

Read about some of the highlights here:

https://mullvad.net/blog/mullvad-review-of-2025

The attack on secure and private communication is worldwide. Now is the time for resistance. Demand transparency from your politicians, and privacy for the people.

4/4

The bill also seeks “Action to prohibit the provision of VPN services to children in the United Kingdom” and wants “all regulated user-to-user services to use highly-effective age assurance measures to prevent children under the age of 16 from becoming or being users.” In practice, this means identity checks for VPN users, making things like anonymous whistleblowing difficult.

3/4

Once again, they use “what about the children”, this time to install state spyware that would continuously scan every action on a phone or tablet and watch everything that is shown on the screen. This will effectively ban end-to-end encrypted communication and open source operating systems like GrapheneOS and forbid that people have administrator rights on their own devices.

2/3

The war on privacy and encryption goes on. This time in the UK. Under the “Children’s Wellbeing and Schools Bill”, lawmakers now want client-side scanning on every phone and tablet.

The lawmakers write: “Any relevant device supplied for use in the UK must have installed tamper-proof system software which is highly effective at preventing the recording, transmitting (by any means, including livestreaming) and viewing of CSAM using that device.”

1/2

@nprofile1q...

"The name GotaTun is a combination of the original project, BoringTun, and Götatunneln, a physical tunnel located in Gothenburg."

GotaTun is a WireGuard® implementation written in Rust aimed at being fast, efficient and reliable. Now available to all Android users, we aim to ship it to the remaining platforms next year.

Read more here: https://mullvad.net/blog/announcing-gotatun-the-future-of-wireguard-at-mullvad-vpn

Mullvad has spent the last three years opposing Chat Control 2.0 – even though the law would have affected our business positively.

We will continue to fight Going Dark with full force, regardless of whether VPNs are included or not. If VPNs are included, and if Going Dark becomes law, we will never spy on our customers no matter what.

The EU Commission and several member states are also looking for new rules on data retention. In a new ”Presidency outcome paper”, the member states discuss metadata retention: which websites you visit, and who is communicating with whom, when and how often. The ambition is “to have the broadest possible scope of application” and this time some member states also want the proposal to include VPN services.

The European Commission lost the Chat Control 2.0 battle over access to end-to-end encrypted data. By the summer 2026, they will be back with their next attempt: Going Dark. This time some EU member states want to include VPN services.

The Going Dark initiative, or ProtectEU as the Commission now calls it, wants to “enable law enforcement authorities to access encrypted data in a lawful manner”. This is a Chat Control 3.0 attempt.

This is the final reminder that we are fully removing support for OpenVPN on January 15th 2026, in a month's time.

Read more here: https://mullvad.net/blog/final-reminder-for-openvpn-removal