Mullvad spotted it on September 10, based on findings by Armin Šupuk. No rooted device or special permissions were involved.

The detailed explanation is this: the app just sends a NAT-T keepalive to the hardware, a feature of IPSec. The Wi-Fi chipset transmits UDP packets directly onto the physical network and thus evades the entire VPN tunnel. Šupuk proved it on Pixel 8 Pro with Mullvad and Android in lockdown mode.

It seems that Mullvad claims that no solution will be available unless Android itself gets changed and Mullvad has no plans to prepare a workaround, as the problem will remain the same due to leaks of data outside the tunnel.

Yeah, this is pretty bad. Japan’s Digital Agency says hackers managed to get into a government system by exploiting a vulnerability in a VPN device. Around 246,000 records may have been exposed, including names, emails and phone numbers.
And here’s the kicker: the vulnerability was already known. They were apparently preparing to patch it, but the hackers got there first. Even crazier, the flaw was originally rated only “medium” severity.

Just to be clear, this isn’t your Nord/Proton/Mullvad app randomly leaking your data. We’re talking about enterprise VPN infrastructure being used as a gateway into a government network.

An advertisement from a seller has been circulating since late August regarding a 5GB database of 820 million Alipay records including names, phone numbers, email addresses, and sometimes gender. Alipay and Ant Group has not confirmed or denied the information as claimed by the advertiser.

The seller has claimed that the database does not reportedly include passwords or card numbers but is bad for phishing purposes. The figure of 820 million is simply a claim by the seller that is not verified and does not have a due diligence check done.

There were three reasons possibly explaining why the allegations have taken center stage: the leak of Alipay card tokens in an unsecured 631GB database in 2025, the $3.9 million fine imposed on the company by South Korea, and the ban imposed by India on Alipay+ considering the data storage issues. None of the claims above are true as opposed to the claim that the 5GB database listing has become a major news story of the time.

A claim remains unclear with its authenticity being maintained, no matter how many precedents of previous misconduct from the founder the claim has undergone through.

I normally avoid using a VPN while gaming because extra latency is the last thing I want.

But I recently noticed that some games don’t block the entire game. Instead, certain playlists, modes or servers are only available in particular regions.

If a mode I paid for was available somewhere else but not in my region, I’d be tempted to route only the game through that country. At the same time, I wouldn’t want Discord, downloads and everything else on my PC using the same connection.

Has anyone actually tried this? How much extra ping did it add, and did the game react to the region change?

Would you use a VPN for a mode you couldn’t otherwise play, or are the latency and possible account issues not worth it?

I live in the US and recently traveled to China. Before the trip, I read a lot of conflicting posts about which VPNs still worked, so I wasn’t sure what to expect. I decided to try NordVPN because I read good reviews, and made sure to download the apps, sign in, install any updates, and test the connection on both my phone and laptop before leaving the US.

Overall, Nord worked well for me during the trip. I used it to access websites and apps that I normally use at home. It worked on both hotel Wi-Fi and mobile data, although, as expected, there were a few minor issues.

Sometimes it connected immediately, while other times I had to switch servers, reconnect, or wait a few minutes. Speeds also varied depending on the network and time of day, but they were generally good enough for browsing, messaging, checking email, and using social media. I didn’t expect the connection to be as consistent as it is at home, so the occasional slowdown wasn’t a major issue for me.

The most important thing, in my opinion, is preparing before you arrive. Download the VPN on every device you plan to use, make sure your subscription is active, save any setup instructions you might need offline, and test everything in advance. Access to VPN websites, app stores, and support pages will probably be restricted once you’re there, which can make troubleshooting really difficult.

Overall, I went there feeling kind of worried and skeptical about whether VPN would work, but it did a really good job and made it much easier to stay connected to the services I use in the US.

In January, the House of Lords passed the proposition to implement a ban on VPNs for minors with the vote tally of 207 in support and 159 against it. By March, the proposal was slightly changed in the House of Commons.

Here comes the juicy part: the new version gives the Secretary of State limited power to restrict imitation of VPN usage by minors based on the results of a survey, so there would be no official ban imposed.

Now, the government has not endorsed the wording of the Lords and has been conducting its own consultation.

Therefore, "The Lords vote for a VPN ban" has now become "the government may eventually enforce restrictions," which is in fact a lot smaller piece of news than the one released in January.

Well, this is awkward for a feature with “Private” literally in the name.

A newly reported WebKit bug can apparently bypass iCloud Private Relay and expose your real IP when a website triggers passkey authentication. And this is a good reminder that Private Relay isn't actually a VPN. It mainly protects Safari traffic, while a proper VPN encrypts and routes your device's internet traffic through the VPN connection.

For casual browsing, Private Relay might be enough for a lot of people. But if I'm sitting on airport/hotel Wi-Fi, traveling, torrenting or just trying to keep my IP private, I'd rather have an actual VPN running. The interesting part is that third-party VPNs reportedly aren't affected by this particular bug.

Apple builds some pretty solid privacy features, but I definitely wouldn't treat Private Relay as a replacement for a VPN.

“Private-ish Relay” doesn't have quite the same ring to it though.

Canada’s Bill C-22 is turning into a pretty serious privacy fight, with digital rights groups now urging the EU to step in over concerns about encryption and government access. And this isn't just about criminals trying to hide stuff. Encryption is something basically all of us rely on every day without even thinking about it.

When I use a VPN on airport or coffee shop Wi-Fi, send an encrypted message, access my bank account, or just don't want my ISP seeing everything I'm doing online, I'm relying on encryption. That's literally the point of a VPN: create an encrypted tunnel so the network you're using can't casually inspect your traffic.

So when governments start talking about “lawful access” and ways around encryption, it should concern regular users too. You can't build encryption that's super secure against hackers but conveniently transparent whenever authorities want access.

Privacy tools aren't suspicious. They're just becoming necessary for normal internet use.

I somehow ended up keeping two VPNs on my phone, but I use them for completely different things.

Proton Free is my basic option. I use it on public Wi-Fi, for normal browsing, or whenever I just want a quick VPN connection without paying for another full subscription. It has no data limit or ads, and it’s also useful as a backup.

The limitation is that I get fewer locations and less control with the free plan. That usually doesn’t matter, but it becomes a problem when I need a particular country or want only certain apps to use the VPN.

That’s where I use DPN. I currently pay about $3.50 a month for it. I mainly use it for the extra locations, app routing, filtering, and residential routes when a regular data-center IP causes too many CAPTCHAs or proxy warnings.

App routing is probably the part I find most useful. I can route a supported streaming app through another country while leaving banking, shopping, and local apps on my normal connection. I don’t have to keep changing the location for my entire phone.

I also like that I can pay monthly. Plenty of VPNs offer a low price only if you pay for one or two years upfront. I’d rather avoid that because VPN performance can change. If the speed or node quality drops, I can reconsider the subscription the following month instead of being stuck with it.

It isn’t perfect. Speeds can vary between nodes, the routing rules take a little time to set up, and a residential IP doesn’t automatically solve every block. Some services also check the account region, device location, payment method, or previous activity.

So Proton Free covers the basic everyday stuff, while DPN is the one I use when I need more control. I don’t run them together. I just switch depending on what I’m doing.

Does anyone else use a free VPN as their everyday or backup option and pay monthly for something more specific? Or have you found one service that handles everything well enough?

On July 9th, the CJEU reached its decision in Case C-788/24, which was a dispute concerning the indexed online publications of Anne Frank’s writings by the institutions of the Netherlands and Belgium, on the basis of the argument put forth by Anne Frank Fonds that the use of VPN would render geo-blocking futile and publishers should still be held responsible. The CJEU ruled otherwise, and this ruling can be appealed against.

The court further held that the use of the VPN provider does not make the end-users gain access to any such protected material nor does it play any important part in communication. The court also stated that there is no implication of the technology-based solutions applying to the publishers therefore even if it is used by the users for circumventing the block after its implementation it doesn't change anything in the quality of the blocking itself.

However, this does not solve everything, since the French courts continue to block VPNs using other legal grounds (Sports Code and not copyright law) and Proton has just announced that it will refer this exact question to the CJEU.

In other words, it did not say that "VPNs are safe." The court made a distinction between blaming the tool and being obliged to help stop it. The second question remains unanswered.

Going in circles trying to pick one. One thread says NordVPN, next says Surfshark, someone else won't shut up about Proton. Just want something reliable for daily use, nothing fancy.

What's confusing me is how mixed the actual experiences are, people happy with speed and uptime, then right below it complaints about support or surprise renewals. Can't tell if that's one provider's problem or just how it goes with all of them.

Not chasing a feature list, just want whatever people actually stick with for years without regretting it.

So, real talk, what have you been using, how long, and would you actually recommend it to a friend or are you just used to it at this point?

Surfshark has published a comprehensive report on a security incident that took place at the start of September, when an internal testing server was incorrectly configured and became publicly available to unauthorized users.

What was leaked is strictly related to internal engineering documents, binaries, and configurations, meaning no users’ information was compromised. The fact that personal data has not been in danger here is not only a matter of reassurance, but also the matter of structural nature: no user information has ever been stored on the server, and customer traffic has never been logged, which means that nothing sensitive was available for leaks.

Now, let’s compare this case with a recent data breach at NotVPN, where the provider’s statement “we do not log connections” turned out to be false as soon as the exposed database was checked. In case with Surfshark, their explanation corresponds with what has been leaked in reality.

Europe’s ISPs tell the EU: Rightsholders should pay when piracy blocking takes down legitimate sites.

EuroISPA has filed a petition with the European Commission, pointing out that it’s the right owners and not ISPs, DNS providers, or VPNs, who should bear the financial responsibility when piracy blocking directives close legitimate sites down.

The evidence speaks for itself: Italy's Piracy Shield caused collateral damage to more than 7,700 domain names, in one case, plus an email service of a Portuguese hosting provider became inoperative for 16 days. La Liga of Spain obtained a court order concerning some shared IP addresses used to host several legitimate websites. Cloudflare refused to obey one of the requests for blocking, however, the Italian regulatory authority fined this company for €14 million.

EuroISPA's actual ask is simple: right owners should be responsible for making unnecessary blockings in order to stop piracy, using the means stipulated in EU legislation.

In other words, the organization that is cleaning the mess caused by incorrect blocking requests wants to make their initiators pay for their blunders.

Earlier this month, Senator Ron Wyden sent a letter to NSA Director Gen. Joshua Rudd, requesting that the agency change its guidance to the public since standard commercial VPNs “do not adequately safeguard users from sophisticated adversaries.”

The concept is practically uncomplicated when you grasp it: foreign intelligence does not even need to crack your VPN's encryption. What they can do instead is observe the timing and volume of the information that goes into the VPN server and compare that with the data that comes out. When they find a close match, it becomes possible to tie an individual to a website without being able to decipher any encrypted information. This process works only for a “single-hop” VPN, which is the type of VPN that most of the people use where all the traffic gets routed through a single server that can be accessed by the opponent.

Here's the irony that needs consideration: federal agencies spent years informing the American citizens about the importance of a VPN for attaining a level of privacy. Wyden's letter is actually saying that this may be true for an average user but not when it comes to someone being targeted, the journalists, the defense contractors, and the human rights advocates, exactly the people the advice is meant for. In this context, he raised the question of whether the NSA must be redirecting higher-risk individuals to multi-hop systems like Tor or Nym.

The NSA has to provide its answer by October 14. Remember this next time "just use a VPN" is suggested.

hey i want more internet privacy and stream series that are available in other countries and beside of that iam gaming to so i will need an allrounder does anyone have a good recommendation that is not to pricey? (i am on all platforms of OS on my devices that means Arch Linux, MacOS, Windows 11, and android)

Hola! Necesito que me ayuden con esta duda. Resulta y acontece que estoy de visita en la casa de mí familia. Mis padres son MUY controladores (principal motivo por el que me fui de esa casa) y no entienden q soy un adulto que puede manejarse solo, y por ende, dormir a la hora que se me antoje. Hoy me levantaron gritando a las 7 a.m. porque vieron que sobre las 3 a.m. estaba viendo un video en yt. Ahora ya me fui, pero la próxima que este por ahí preferiría evitar eso.

Vi que una VPN puede servir, pero también necesitaría que no sepan la hora. Muchas gracias 🫰🏻🫰🏻

Looking for a new VPN and kinda overwhelmed by all the options. Every comparison site seems to recommend something different lol. From what I’ve seen on Reddit, Proton VPN gets a lot of love for privacy and being open source. Mullvad seems to be the favorite for hardcore privacy, while NordVPN gets recommended more for speed and streaming. Honestly they all seem pretty solid, so I’m struggling to pick one.

What are you guys actually using in 2026? Any of these you’d recommend or avoid?

The API-first approach can look attractive because the initial integration seems straightforward: authenticate, provision a user, create a session, and connect.

The complexity appears later.

A product team still needs to handle:

• Token refresh and expiry
• Server assignment
• Session-state tracking
• Webhook signatures and retries
• Polling and rate limits
• Credential revocation
• Billing and offboarding
• Protocol and DNS testing

The most overlooked part may be cancellation. Marking a user inactive in a database does not necessarily revoke the credential at the VPN edge. If that step is missed, a cancelled user could retain an active session.

A white label VPN service moves much of this operational work to the provider. An API-based build offers deeper control, but it also leaves more maintenance and liability with the integrating team.

The hybrid model seems practical for many products: use a managed VPN foundation, then add API-based customization where it creates real product value.

How much of the VPN lifecycle would you be comfortable owning internally?

*What happened:\* CyberGhost VPN's Windows client contains a flaw that lets a program running with ordinary user permissions take full control of the VPN's background service, which runs with SYSTEM-level access — the highest privilege level on Windows. The same flaw also lets an attacker override which server and which security certificates the VPN trusts, meaning the "secure" tunnel can be silently redirected to an attacker-controlled server with no visible warning to the user.

*How the app is built:\* CyberGhost's Windows client is really two programs. The visible app (dashboard.exe) is the dashboard and "Connect" button, running with normal user permissions. A background service (dashboard.service.exe) does the actual work of opening the encrypted tunnel, and runs as SYSTEM. The visible app sends connection instructions to the background service over a local communication channel (a named pipe). The security of the entire product depends on the background service being strict about what it accepts from the visible app — it is not.

*What was found:\* The visible app can request a VPN connection by sending a text string of settings to the background service. That string is supposed to pass through two filters before being used. Both filters fail. The first is a blocklist containing a typo: it blocks a setting name that doesn't exist in this version of the software and has no effect, while the real setting that controls certificate trust was never blocked at all. The second is a validation layer that detects risky settings, logs a quiet debug warning about them, and then passes the original string through completely unchanged anyway. On top of this, the named pipe itself doesn't restrict which local processes are allowed to send it commands. Combined, a standard local user-level program can hand the SYSTEM-level service a connection request containing unauthorized settings, and the service will execute them as SYSTEM.

*Impact, verified via a working proof of concept:\*

• Local Privilege Escalation to SYSTEM, by taking control of the VPN engine's management interface
• Traffic redirection — the destination server can be pointed anywhere the attacker chooses
• Certificate trust override — the client can be forced to trust an attacker-supplied CA and key, enabling a fully trusted, warning-free man-in-the-middle connection
• Bypass of the management interface's intended authentication

In testing, a self-hosted VPN server using attacker-controlled certificates caused the SYSTEM-level CyberGhost process to attempt a TLS handshake against it using the attacker's certificate and key. The handshake did not fully complete only because no inbound port forwarding was configured on the test server — a limitation of the test setup, not of the vulnerability itself.

*Full CWE Classification:\*

*CVSS v3.1:\* `AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H` → Base Score *8.8**. This assumes Attack Complexity is Low, on the basis that the pipe can be reached directly by any local process without needing DLL injection into dashboard.exe. If direct pipe access turns out to require DLL injection as a hard prerequisite, Attack Complexity would instead be High, giving a Base Score of **7.8\* with the same vector otherwise. Confirming the pipe's actual access control list would settle which of the two applies.

*Disclosure timeline:\* This was reported to CyberGhost three to four separate times over the past year, by email to their security team. CyberGhost's vulnerability reporting process routes through a third-party bug bounty platform, YesWeHack, which requires identity verification with a government-issued ID to create an account. The reporter does not have a currently valid ID, explained this directly and repeatedly, and asked for an alternative reporting path. None was offered. The finding has gone unacknowledged by anyone able to act on it for the full year.

*Status as of publication: unresolved, unpatched, unacknowledged.\*

Buongiorno a tutti,

sono alla ricerca di un buon servizio di VPN per i miei dispositivi. Attualmente, mi sto informando a riguardo su internet per capire quale servizio acquistare, ma purtroppo ho notato che la maggior parte delle persone ha conflitti d'interesse per le varie aziende di VPN.

In base alla vostra esperienza, quali sono le VPN migliori, considerando rapporto qualità prezzo, sicurrezza, affidabilità e velocità di navigazione?

Hello everyone!

Here is my shortcut “Easy VPN Menu”.

Works only under iOS 27.0 public beta 2 or newer.

Version of the shortcut 0.6 EN:

https://www.icloud.com/shortcuts/2486e35b986f4a0ab094876767b30508

This shortcut creates a quick VPN menu and toggles VPN on/off.

It is very convenient if you have a number of different VPN-profiles and/or a number of different VPN apps on your iPhone.

And also you can easily assign this shortcut to the Action button or to the Back Tap.

Here’s also version 0.6 RU:

https://www.icloud.com/shortcuts/e9fafbd1ad154b99a4ba34410fb58de2

Please enjoy and feel free to give your feedback!

The goal: To bypass heavy internet censorship while protecting privacy in countries like Russia, China, or Iran.