No major vulnerabilities were found in Mullvad’s latest independent security audit, the company said in a blog post on Friday. An audit of Mullvad’s new WireGuard implementation, GotaTun, was conducted by Gothenburg-based Assured Security Consultants between Jan. 19 and Feb. 15, 2026.
The latest audit is Mullvad’s 18th overall since 2017, and further cements the VPN’s position as one of the most transparent in the industry. Among CNET’s top VPN picks, only ExpressVPN has out-audited Mullvad, with 23 audits commissioned since 2018.
Specifically, Assured Security Consultants completed a code audit of GotaTun, Mullvad’s implementation of the WireGuard connection protocol, written in Rust. The audit consisted of a source code review and testing of the entire GotaTun implementation, excluding Mullvad’s AI-traffic analysis blocking DAITA code and its command line interface. Although auditors found no major vulnerabilities in the code, they did flag two security issues of low-risk severity.
The first issue had to do
...Keep reading this article on CNET.
