紧急安全更新：由于 Linux 内核刚被爆出监听 IPv4 MPTCP 极易被远程拿 root，且 Go 1.24+ 默认开了 MPTCP，本版本默认关闭了 MPTCP 以显著减小攻击面（v26.10.29 让位，已被撤版），用户应尽快升级到该版本（该漏洞不止影响 Linux 服务端，安卓客户端的 Socks/HTTP 入站若开启了“允许来自局域网的连接”则也有点危险），并尽快更新 Linux 内核以从根源上修复漏洞

2026.11.04 补充对于 IPv4 Options 和真实网络链路的说明：#7326 (comment)

Sponsors

Sponsor Xray-core

Donation & NFTs

Collect a Project X NFT to support the development of Project X!

• TRX(Tron)/USDT/USDC: TNrDh5VSfwd4RPrwsohr6poyNTfFefNYan
• TON: UQApeV-u2gm43aC1uP76xAC1m6vCylstaN1gpfBmre_5IyTH
• BTC: 1JpqcziZZuqv3QQJhZGNGBVdCBrGgkL6cT
• XMR: 4ABHQZ3yJZkBnLoqiKvb3f8eqUnX4iMPb6wdant5ZLGQELctcerceSGEfJnoCk6nnyRZm73wrwSgvZ2WmjYLng6R7sR67nq
• SOL/USDT/USDC: 3x5NuXHzB5APG6vRinPZcsUv5ukWUY1tBGRSJiEJWtZa
• ETH/USDT/USDC: 0xDc3Fe44F0f25D13CACb1C4896CD0D321df3146Ee
• Project X NFT: https://opensea.io/item/ethereum/0x5ee362866001613093361eb8569d59c4141b76d1/1
• VLESS NFT: https://opensea.io/collection/vless
• REALITY NFT: https://opensea.io/item/ethereum/0x5ee362866001613093361eb8569d59c4141b76d1/2
• Related links: VLESS Post-Quantum Encryption, XHTTP: Beyond REALITY, Announcement of NFTs by Project X

紧急安全更新：由于前几天印度八张中间证书的私钥因过于简单而被破解，本版本内置的 RootCAs 依赖库移除了三张根证书（v26.10.10、v26.10.17 内置有这些证书，已被撤版），并使用 Go 1.27.3 编译以确保即使操作系统 CA 库未更新也会过滤掉问题证书，用户应尽快升级到该版本，月底发 stable release（操作系统的 CA 库可能更新较慢，所以要覆盖掉上一个 latest）

https://t.me/projectXtls/3592 10.22 直接先把该版本设为了 latest，似乎也不是不行，完整的 release notes 等月底或下个月初的版本吧，半年积攒的更新写起来有点酸爽，其实我几乎不用 AI，或许让 AI 来补，顺便 v26.9.8 多余了也被删了

Sponsors

Sponsor Xray-core

Donation & NFTs

Collect a Project X NFT to support the development of Project X!

• TRX(Tron)/USDT/USDC: TNrDh5VSfwd4RPrwsohr6poyNTfFefNYan
• TON: UQApeV-u2gm43aC1uP76xAC1m6vCylstaN1gpfBmre_5IyTH
• BTC: 1JpqcziZZuqv3QQJhZGNGBVdCBrGgkL6cT
• XMR: 4ABHQZ3yJZkBnLoqiKvb3f8eqUnX4iMPb6wdant5ZLGQELctcerceSGEfJnoCk6nnyRZm73wrwSgvZ2WmjYLng6R7sR67nq
• SOL/USDT/USDC: 3x5NuXHzB5APG6vRinPZcsUv5ukWUY1tBGRSJiEJWtZa
• ETH/USDT/USDC: 0xDc3Fe44F0f25D13CACb1C4896CD0D321df3146Ee
• Project X NFT: https://opensea.io/item/ethereum/0x5ee362866001613093361eb8569d59c4141b76d1/1
• VLESS NFT: https://opensea.io/collection/vless
• REALITY NFT: https://opensea.io/item/ethereum/0x5ee362866001613093361eb8569d59c4141b76d1/2
• Related links: VLESS Post-Quantum Encryption, XHTTP: Beyond REALITY, Announcement of NFTs by Project X

See https://github.com/XTLS/Xray-core/releases/tag/v26.10.21

See https://github.com/XTLS/Xray-core/releases/tag/v26.9.30

See https://github.com/XTLS/Xray-core/releases/tag/v26.9.9

See https://github.com/XTLS/Xray-core/releases/tag/v26.7.28

See https://github.com/XTLS/Xray-core/releases/tag/v26.7.11

See https://github.com/XTLS/Xray-core/releases/tag/v26.6.27

See https://github.com/XTLS/Xray-core/releases/tag/v26.6.22

See https://github.com/XTLS/Xray-core/releases/tag/v26.6.1