Xray-core v26.2.6

Xray-core v26.2.6 release notes (February 6, 2026).

Notable TLS changes:

• Removed allowInsecure configuration option; users directed to pinnedPeerCertSha256 and verifyPeerCertByName instead (commit 2c92339f).
• Certificate verification code simplified (commit 760223a) — later identified as fixing a cert verification bypass without security advisory at release.

Other release highlights: dynamic Chrome User-Agent; Finalmask UDP additions (XICMP, XDNS, header-, mkcp-); WireGuard and SS AEAD/2022 UDP support in Finalmask; reduced startup memory footprint.

The TLS simplification commit introduced InsecureSkipVerify = true when pinnedPeerCertSha256 is set, removing a protection layer — if pinning logic had bugs, no fallback certificate verification remained.

Community disclosure (net4people/bbs #672) alleges users were exposed to MITM for ~6 months before public advisory.