Proton VPN rewrote its core in Rust: Stealth arrives on Linux
Proton VPN has replaced the engine inside its apps. The old one was wireguard-go, the reference implementation in Go; the new one is written in Rust and called Proton Protocols, internally ProTUN. Its core is a library named libpvpnclient, a single platform independent WireGuard implementation that every app now shares. The change is in beta and rolling out across Windows, Android, iOS, iPadOS and the Linux desktop app.
Why a company rewrites something that works
The old engine did not sit well next to the languages the apps are actually written in, Kotlin on Android and Swift on iOS, so each platform ended up with its own quirks, its own bugs and its own release schedule. One shared library in Rust makes a fix land everywhere at once, and it removes an entire class of memory errors that C and Go code invites in different ways.
That is plumbing, and plumbing is exactly what decides whether a kill switch actually holds when a connection drops.
What users get now
Two things are already visible. The Linux desktop app received Stealth, the provider's anti censorship protocol, which until now was missing there: the release notes date that to the 21 July beta. And the apps got an advanced kill switch, the kind that blocks traffic when the tunnel is not up rather than merely reconnecting and hoping.
Why Stealth matters where VPNs are filtered
Plain WireGuard is easy to recognise on the wire, so a network that wants to block VPNs blocks it first. Stealth wraps the tunnel so the traffic stops looking like a VPN handshake. It is slower than the bare protocol, and it is the difference between a connection that works in a filtered network and one that does not.
What is not here yet
One component is being reported as shipped when it is not. Muon, a networking layer meant to hide the app's own API connections from the provider watching your traffic, so that neither the domain lookup nor the server name in the handshake gives away that you are talking to a VPN, is groundwork rather than a released feature. The same goes for post quantum cryptography: the new core is described as the foundation for it, not as the delivery of it. Worth keeping straight, because the useful question about any VPN client is which protections exist today.
What to watch
A rewrite of the part that carries all the traffic is a serious change, and beta is the word to keep in mind. The things to check when it reaches stable are the ones users can actually verify: does the kill switch hold on a dropped connection, does Stealth get through the network that used to block you, and does battery life on mobile stay where it was.
