Yesterday (2025-11-11), the most recent major quarterly release of Android (Android 16 QPR1) was pushed to the Android Open Source Project after being delayed since 2025-09-03. We've completed our initial port of #GrapheneOS and all our changes to it and are building an experimental release now.
We received an ASN and IPv6 space for #GrapheneOS from ARIN: AS40806 and 2602:f4d9::/40. We've deployed 2 anycast IPv6 networks for our authoritative DNS servers to replace our existing setup: 2602:f4d9::/48 for ns1 and 2602:f4d9:1::/48 for ns2. BGP/RPKI setup is propagating. We applied for an IPv4 /24 for ns2 via NRPM 4.10 and can apply for one for ns1 after we obtain that one. Our ns1 network has New Jersey, Miami, Los Angeles, Seattle, Frankfurt and Singapore. Our ns2 network currently has New York, Las Vegas and Bern. We'll be expanding both. This provides an overview of worldwide latency for our ns1 cluster via the Rage4 anycast service we currently use for IPv4+IPv6 with ns1:
Ping, mtr, dig, TCP port check and real time BGP looking glass from multiple locations
The Best Ping+MTR combination Ever, plus TCP port checker and DNS diagnostics with dig, plus real time BGP looking glass from multiple locations.
 Here's ns1 via our own IPv6 /48:
Ping, mtr, dig, TCP port check and real time BGP looking glass from multiple locations
The Best Ping+MTR combination Ever, plus TCP port checker and DNS diagnostics with dig, plus real time BGP looking glass from multiple locations.
 Here's ns2 via our own IPv6 /48:
Ping, mtr, dig, TCP port check and real time BGP looking glass from multiple locations
The Best Ping+MTR combination Ever, plus TCP port checker and DNS diagnostics with dig, plus real time BGP looking glass from multiple locations.
 In the future, we plan to use these 2 anycast networks to provide recursive DNS resolvers as an option for our users. For now, it's only for the authoritative DNS used to provide other GrapheneOS services which is what DNS resolver servers query after the root and TLD servers.
Android 16 QPR1 is finally being pushed to the Android Open Source Project. This should have happened on 2025-09-03. We migrated to full Android 16 QPR1 kernel code (GPLv2 tarball) and firmware in September. We couldn't migrate userspace to QPR1 without it being pushed to AOSP. #GrapheneOS
We've deployed our first Vultr server for our anycast ns1.grapheneos.org and will be migrating the whole thing to Vultr as part of improving the anycast network. We are later moving to our own ASN + IP space (we've obtained an ASN and IPv6 /40 from ARIN already and will be applying for our first IPv4 /24 via a special clause for dual stack DNS soon).
Project Zero (Google's security research team) found a remotely exploitable vulnerability impacting Google Messages and reported internally back in June 2025 but the team at Android still have not fixed for the stock OS. People can have their device remotely exploited and taken over without any interaction from the victim with a known vulnerability.
Project Zero
 Another win for us, but truthfully, users shouldn't have to install a third party operating system like #GrapheneOS to have protection against such a thing. Any responsible team would have patched by now. iOS would have. The same applies to getting security patches when they are created. An embargo of up to three months for vulnerability information and patches is unacceptable. We have patches scheduled for March 2026 coming in our security preview releases while most OEMs are just following the monthly Android Security Bulletins. Google's ongoing layoffs and recent misguided changes to the security update model have significantly reduced stock Android security.
Both of the November 2025 patches have been provided in our regular non-security-preview releases for over a month, so we've already had the 2025-11-05 Android security patch level for over a month. Our patch level is set based on providing both the Android and Pixel security patches, so we're leaving it at 2025-11-01 until the Pixel stock OS release and Pixel Update Bulletin are published. The stock Pixel OS also included both November 2025 patches in early September. We expect they made a 2nd October release to ship the November carrier changes and will make a release in mid-November with patches from future Android Security Bulletins. All of the Android 16 security patches from the current December 2025, January 2026, February 2026 and March 2026 Android Security Bulletins are included in the 2025110601 security preview release. List of additional fixed CVEs: Critical: CVE-2025-48631, CVE-2026-0006 High: CVE-2022-25836, CVE-2022-25837, CVE-2023-40130, CVE-2025-22420, CVE-2025-22432, CVE-2025-26447, CVE-2025-32319, CVE-2025-32348, CVE-2025-48525, CVE-2025-48536, CVE-2025-48555, CVE-2025-48564, CVE-2025-48565, CVE-2025-48566, CVE-2025-48567, CVE-2025-48572, CVE-2025-48573, CVE-2025-48574, CVE-2025-48575, CVE-2025-48576, CVE-2025-48577, CVE-2025-48578, CVE-2025-48579, CVE-2025-48580, CVE-2025-48582, CVE-2025-48583, CVE-2025-48584, CVE-2025-48585, CVE-2025-48586, CVE-2025-48587, CVE-2025-48589, CVE-2025-48590, CVE-2025-48592, CVE-2025-48594, CVE-2025-48596, CVE-2025-48597, CVE-2025-48598, CVE-2025-48600, CVE-2025-48601, CVE-2025-48602, CVE-2025-48603, CVE-2025-48604, CVE-2025-48605, CVE-2025-48609, CVE-2025-48612, CVE-2025-48614, CVE-2025-48615, CVE-2025-48616, CVE-2025-48617, CVE-2025-48618, CVE-2025-48619, CVE-2025-48620, CVE-2025-48621, CVE-2025-48622, CVE-2025-48626, CVE-2025-48628, CVE-2025-48629, CVE-2025-48630, CVE-2025-48632, CVE-2025-48633, CVE-2025-48634, CVE-2026-0005, CVE-2026-0007, CVE-2026-0008 2025110601 provides at least the full 2025-12-01 Android security patch level (a Pixel Update Bulletin for November 2025 hasn't been released could have fixes we don't get early, although it's likely empty) but will remain marked as providing 2025-11-01. View quoted note →
Linus Tech Tips tried out #GrapheneOS. Check it out: