sing-box 1.14 enables Chrome QUIC fingerprint simulation for Hysteria2 by default, but the release notes explicitly warn that servers using Ed25519 certificates will experience handshake failure when this option is active, requiring operators to disable the fingerprint option or switch certificate algorithms.

China's CAC Phase 2 'Clearance·Rectify AI Application Chaos' campaign (reported 2026-09-02) removed 5.61 million pieces of content, processed 49,000+ accounts, and actioned 2,400+ websites and apps. Enforcement extended beyond post-publication removal to include AI-generated content labeling mandates, corpus auditing in generative AI products, and app-store developer vetting with retrospective re-testing of live apps.

§China CAC enforcement policy

sing-box 1.14.0 (released 2026-08-31) added OpenVPN client and server, OpenConnect, and Snell protocol support alongside L3 forwarding, network namespaces, a REST API, Dashboard UI, and desktop client. The release also adjusted DNS rule semantics, TUN, TLS, Hysteria2 fingerprint behavior, and rule-set processing.

§sing-box 1.14 deployment

sing-box 1.14 breaks Apple platform continuity: users of the legacy App Store app 'sing-box VT' must manually migrate to the new 'sing-box MT' under a new developer account, while the macOS 'SFM' client is no longer distributed through the App Store at all. Profiles and settings from the old sandboxed app are not automatically inherited by the replacement.

§sing-box 1.14 Apple migration deployment

sing-box 1.14 deprecates several DNS configuration fields — including old address-filter fields, the old `strategy` action, and `rule_set_ip_cidr_accept_empty` — with removal planned for version 1.16. Configurations using these fields will continue running until 1.16 but accumulate silent technical debt.

§sing-box 1.14 deployment

TLS ClientHello length-field permutation tests show that GFW II's parsing behavior matches an older tagged version of TSG's SSL module, while Kazakhstan and Pakistan (DROP mode) exhibit parsing behaviors consistent with TSG QUIC plugin deployments. QUIC version fingerprinting further confirms Kazakhstan runs an older version of TSG's QUIC parsing code, and Myanmar's supported QUIC versions exactly match TSG's, spanning at least five countries confirmed or plausibly running TSG components.

2026-ablove-technical-analysis-geedge §6.4, §6.5, Table 8, Table 9 dpitls-fingerprinthttp3-quic-blocksni-blocking

The TLS-Attacker suite is being extended to cover QUIC and DTLS 1.3 under a universal analysis framework that reuses existing Workflow Trace and Modifiable Variable machinery with only protocol-specific components added. As of 2024 the QUIC dialect is functional, making TLS-Attacker the only open-source tool that can fuzz TLS, DTLS, and QUIC handshakes under a single scriptable API.

2024-niere-tls-attacker §2 Development / §3 Outlook tls-fingerprinthttp3-quic-block

TSG's Context-Based Detector (CBD) evaluates circumvention tool signatures across JA3/JA4 TLS fingerprints, SSL certificate issuer fields, UDP payload length, first-packet byte patterns, server IP ranges, and FQDN matches, often combining multiple conditions with logical AND. Of 29 VPN and circumvention tool signatures logged in the VPN Signature File Update Log (March–November 2024), 21 carry risk level 5 (the maximum), indicating aggressive prioritization of blocking major tools including ExpressVPN, NordVPN, Tor Browser, and Psiphon.

2026-ablove-technical-analysis-geedge §4.1, §4.1.2, Table 3, Table 4 dpitls-fingerprinttraffic-shapeip-blockingsni-blocking

AnyTLS implements a persistent idle-session pool with configurable parameters: idle_session_check_interval (default 30s), idle_session_timeout (default 30s), and min_idle_session (default 5). The client maintains at least 5 pre-established TLS sessions at all times to enable fast connection reuse without a new TLS handshake per request.

2026-anon-anytls-anytls-sing-box-2026 §2.4, §5.3 tls-fingerprinttraffic-shape

Compared to peer protocols, AnyTLS rates 'medium' performance (vs. VLESS 'high', Hysteria2 'very high', TUIC 'high'), uses TCP/TLS transport (vs. UDP/QUIC for Hysteria2 and TUIC), and relies on padding-based obfuscation vs. REALITY/WebSocket (VLESS) or HTTP/3 framing (Hysteria2). Client ecosystem support is currently limited primarily to sing-box, vs. broad cross-client support for VLESS, Trojan, and Hysteria2.

2026-anon-anytls-anytls-sing-box-2026 §1.5, Table 1.5 traffic-shapetls-fingerprint

AnyTLS is a TLS-based proxy protocol maintained by the sing-box team, designed in 2024 and first released in the sing-box dev-next branch. Its core mechanism wraps arbitrary proxy traffic in standard TLS and applies a configurable padding scheme (Padding Scheme) to enhance traffic concealment while maintaining compatibility with standard TLS infrastructure.

2026-anon-anytls-anytls-sing-box-2026 §1.1–1.3 tls-fingerprinttraffic-shapedpi