If you're running WireGuard on a MikroTik router, this is probably worth paying attention to.

A recently disclosed vulnerability affects certain MikroTik RouterOS versions and could allow an attacker with authenticated access to recover WireGuard session information including session keys under specific conditions. Following the disclosure, CISA has added the flaw to its Known Exploited Vulnerabilities catalog and is urging organizations to update affected systems and strengthen their configurations.

What's interesting is that this isn't a flaw in the WireGuard protocol itself. The issue is tied to how the VPN was implemented within affected RouterOS versions. That's an important distinction because it's easy to see a headline mentioning WireGuard vulnerability and assume the protocol itself has been broken.

For anyone managing MikroTik hardware, the advice is fairly straightforward, install the latest RouterOS updates, review your WireGuard configuration and don't leave management interfaces unnecessarily exposed to the internet. Organizations using these routers for remote access should also verify that only trusted users have administrative access.

Stories like this are a good reminder that even when a VPN protocol has a strong security reputation, the surrounding software still needs regular maintenance. A secure protocol can't compensate for vulnerabilities in the platform it's running on.

If you use WireGuard, is it running on a dedicated router like MikroTik or do you mostly use it through desktop and mobile VPN clients?

One thing I've always told friends is, If you're downloading a VPN, make sure you're getting it from the official source.

Apparently, that's becoming more important than ever.

Researchers have uncovered hundreds of fake VPN download pages that were being hosted through trusted platforms and cloud services associated with major tech companies. Instead of taking users to legitimate VPN installers, these pages redirected victims to malware designed to steal passwords, browser cookies, cryptocurrency wallets and other sensitive data. Because the links were hosted on well known platforms, they often looked far more trustworthy than a typical phishing website.

What's worrying is that many people don't look beyond the domain they click. If they see a familiar company name in the URL, they naturally assume it's safe.

The campaign reportedly impersonated several well known VPN providers making it even easier for attackers to trick people who were simply searching for a VPN to improve their privacy.

The biggest takeaway isn't that VPNs are dangerous, it's that where you download them from matters just as much as which VPN you choose.

It's a good reminder to:

• Download VPN apps directly from the provider's official website or official app stores.
• Be cautious of sponsored search results or random download pages.
• Double check the URL before installing anything.
• If something asks you to disable your antivirus or browser protections during installation that's a major red flag.

It's interesting how cybercriminals keep targeting privacy conscious users. The people trying to improve their security can end up being the ones targeted by fake security tools if they're not careful.

This is one of the more unusual cybersecurity stories I've seen recently.

The US Treasury has announced sanctions against First VPN Service (1VPNS), making it the first VPN provider to be sanctioned by the agency. But this wasn't aimed at VPNs as a technology, it was directed at a service that authorities say was deeply involved in supporting ransomware operations.

According to the Treasury, 1VPNS wasn't simply a VPN that criminals happened to use. Officials allege the service actively catered to ransomware groups and other cybercriminals by providing infrastructure that helped them hide their locations, deploy malware, communicate during attacks and manage stolen data after breaching victims. Those victims reportedly included hospitals, financial institutions, municipal governments and private businesses across the United States.

Authorities also say the service had been operating since 2014 and openly advertised on cybercrime forums, promoting features such as not keeping user logs and refusing to cooperate with law enforcement investigations involving activity originating from its servers. Investigators claim its administrator even used false identities to obtain hosting infrastructure after providers became aware of abuse complaints.

This latest move wasn't the first action taken against the service.

Back in May, an international law enforcement operation involving European authorities and the FBI seized 1VPNS infrastructure and disrupted its operations. The new sanctions are another step designed to make it harder for the people behind the service to continue operating or conduct business involving US persons or assets.

Another part of the announcement that caught my attention is that the Treasury also sanctioned a separate individual accused of selling cryptors, tools designed to disguise ransomware and other malware so security software is less likely to detect it. It shows that regulators are increasingly targeting the entire ransomware ecosystem not just the groups launching attacks.

I think it's important to separate this story from the broader conversation around consumer VPNs.

Millions of people use VPNs every day for perfectly legitimate reasons like protecting themselves on public WiFi, securing remote work connections or improving online privacy. This action wasn't a crackdown on those uses. Instead authorities argue that this particular provider intentionally built and marketed infrastructure for cybercriminals rather than simply offering a privacy service that happened to be abused by bad actors.

It also raises an interesting question about how people evaluate VPN providers.

Should transparency, public ownership, independent audits and accountability matter more when choosing a VPN? Or is this an isolated case that doesn't really change how you think about mainstream VPN services?

Good news for Linux users who prefer installing software through Snap packages.

Proton VPN has officially released its own Snap package making it possible to install the app with a single click on Ubuntu and other Linux distributions that support Snap. Until now Snap users mostly relied on a community maintained version rather than an official release from Proton itself. The new package is also published with a verified publisher badge making it easier to confirm you're installing the official client.

The initial release isn't feature complete.

According to Proton, the Snap version currently doesn't include split tunneling, the Stealth protocol, or ARM support. The company says these features are missing because of Snap's sandboxing limitations and that it's looking at ways to improve support over time.

Even with those limitations, this is probably a welcome change for Linux users who want a simpler installation process instead of manually adding repositories or configuring packages through the terminal.

A new academic study looked at 281 free android VPN apps available on google play and the findings raise some concerns about how well many of them actually protect users.

According to the researchers, 29 apps leaked DNS or browser traffic, meaning some user activity could bypass the VPN tunnel altogether. They also found that 61 apps transmitted certain traffic outside the encrypted tunnel including sensitive configuration data and, in some cases, location related information. More than 20% of the apps transferred some content without encryption and over 60% lacked basic security hardening that would make them more resistant to attacks.

The study doesn't suggest that every free VPN is unsafe but it does highlight a bigger issue just because an app says VPN doesn't automatically mean it delivers the level of privacy or security that users expect.

For most people, it's easy to assume that once the VPN icon appears everything on the device is fully protected. This research is a reminder that implementation matters just as much as the feature list.

One thing that stood out to me is that choosing a VPN shouldn't be based only on download numbers or play store ratings. Things like independent security audits, transparent privacy policies, open source apps and a provider's track record probably deserve a lot more attention than they usually get.

This post contains content not supported on old Reddit. Click here to view the full post

I started looking for a gaming VPN because I kept seeing mixed opinions online.

Some people swear a VPN lowers their ping while others say it only makes things worse. After digging through Reddit discussions, provider documentation and plenty of user experiences, I realized the answer isn't as straightforward as VPN = better gaming.

In most cases, a VPN won't magically reduce your ping. What it can do is improve routing in certain situations, protect your IP address and help you access game servers or region specific content.

If gaming is your main reason for buying a VPN, these are the things I'd pay attention to.

What actually matters in a gaming VPN?

A flashy homepage doesn't mean much if the VPN performs poorly in game.

These are the features I'd prioritize:

• Low latency
• Stable connections
• Fast WireGuard or equivalent protocol
• Large server network
• DDoS protection
• Minimal speed loss
• Reliable apps for Windows and consoles (where supported)

VPNs that gamers recommend most often

NordVPN

One of the most frequently recommended gaming VPNs.

Its NordLynx protocol is extremely fast and many players report stable performance across competitive games.

Good for

• Competitive gaming
• Low latency
• Large server selection
• DDoS protection

Things to consider

• Limited to 10 simultaneous devices.

Surfshark

A great option if you game on multiple devices or share a subscription with family or friends.

Good for

• Unlimited devices
• WireGuard support
• Affordable pricing
• Fast downloads

Things to consider

• Some servers perform better than others, so switching locations occasionally helps.

ExpressVPN

One of the easiest VPNs to set up especially if you don't want to spend time tweaking settings.

Good for

• Stable performance
• Excellent router support
• Reliable server network
• Cross platform compatibility

Things to consider

• Usually costs more than competitors.

Proton VPN

Often recommended by users who value privacy alongside gaming.

Good for

• Fast WireGuard servers
• Strong privacy
• Reliable desktop apps

Things to consider

• Best gaming servers are available on paid plans.

Private Internet Access (PIA)

Frequently recommended by experienced users who like having more control over settings.

Good for

• Large server network
• Port forwarding (where available)
• Customization options

Things to consider

• Speeds can vary depending on the server.

Will a VPN lower your ping?

This is probably the biggest misconception.

For most people, no.

Adding a VPN means your traffic takes an extra step before reaching the game server, which can increase latency.

However, there are situations where a VPN can actually help:

• Your ISP uses inefficient routing.
• Your ISP is throttling gaming traffic.
• A VPN offers a more direct route to the game server.
• You're connecting to a nearby VPN server with excellent network infrastructure.

Those cases exist but they're the exception rather than the rule.

Reasons gamers use VPNs

Besides ping, there are plenty of other reasons people game with a VPN:

• Protection against DDoS attacks.
• Playing while connected to public WiFi.
• Accessing region specific servers.
• Playing while traveling.
• Avoiding ISP throttling (where applicable).
• Protecting your real IP address during competitive games.

Features worth looking for

If you're comparing providers, I'd check whether they offer:

• WireGuard or another high speed protocol.
• Kill Switch.
• Split Tunneling.
• Router support.
• Dedicated gaming servers (if available).
• Fast local servers.

What about consoles?

Since PlayStation, Xbox, and Nintendo Switch don't support VPN apps directly, you usually have three options:

• Install the VPN on your router.
• Share a VPN connection from your PC.
• Use Smart DNS if your provider offers it (mainly useful for streaming rather than privacy).

Are free VPNs good for gaming?

Personally, I wouldn't recommend them.

Gaming requires low latency and stable speeds while free VPNs often have:

• Limited bandwidth.
• Crowded servers.
• Higher latency.
• Data limits.
• Fewer server locations.

Those limitations usually become noticeable pretty quickly during online matches.

My takeaway

If gaming is your priority, I'd focus less on marketing claims about lower ping and more on consistency.

A VPN should provide stable speeds, reliable connections, and nearby servers. Features like WireGuard support, good routing, and a large server network will usually make a much bigger difference than any promise of magically improving latency.

From everything I looked into, NordVPN, Surfshark, ExpressVPN, Proton VPN, and Private Internet Access are the providers that come up most consistently among gamers for overall performance.

If you've been gaming with a VPN recently, has it actually improved your experience or do you mainly use it for privacy and DDoS protection?

I've been seeing a lot of headlines claiming that India is about to ban VPNs but the situation is a bit more nuanced than that.

From what has been reported, VPNs themselves are not being banned. Instead, the focus is on tightening regulations around VPN providers operating in the country. Existing CERT-In rules already require providers with servers in India to retain certain customer information for at least five years and there are reports that the government is considering additional compliance requirements including designated points of contact for law enforcement.

These regulations have already had a noticeable impact on the industry. Several major VPN providers previously removed their physical servers from India and now offer Indian IP addresses through virtual servers located outside the country, allowing them to continue serving users while avoiding the local data retention requirements.

Another recent development is that authorities have instructed VPN providers to help prevent access to certain blocked gambling and prediction market platforms, showing that regulation is expanding beyond just data retention.

For everyday users, the biggest takeaway is that using a VPN for legitimate purposes remains legal but the regulatory environment for VPN companies is becoming more restrictive. It also explains why so many providers have changed the way they operate in India over the past few years.

It'll be interesting to see whether future rules focus mainly on providers with infrastructure inside India or whether they have a broader impact on how VPN services are offered to Indian users.

One thing I don't see talked about very often is the permissions that VPN apps ask for.

A lot of people install a VPN, tap "Allow" a few times and never think about it again. That's understandable, most of us just want the VPN connected as quickly as possible.

But if you've ever looked through your phone's permission settings, you might have wondered why a VPN app needs access to certain things. Are those permissions actually required or are they collecting more information than necessary?

After reading through documentation from several VPN providers and comparing how Android, iOS, Windows, and macOS handle VPN apps, here's what I found.

First, not every permission comes from the VPN company

This is probably the biggest misconception.

Some permissions are required because of how the operating system creates a VPN connection. Others are optional features that you can choose to use or ignore.

So seeing a permission request doesn't automatically mean the VPN is doing anything suspicious.

Common permissions you'll see

VPN Connection Permission

This is the permission everyone sees.

On Android and iOS, the system asks whether you want to allow the app to create a VPN connection. Without this permission, the app simply can't function.

Verdict: Completely normal and required.

Network Access

A VPN obviously needs internet access to connect to its servers and route your traffic.

Without it, the VPN wouldn't be able to encrypt or transmit anything.

Verdict: Required.

Notification Permission

Many VPN apps ask to send notifications.

These are usually used for things like:

• Connection status
• Kill Switch alerts
• Subscription reminders
• Security warnings

If you don't want notifications, you can usually disable them without affecting the VPN itself.

Verdict: Optional.

Location Permission

This is the one that confuses people the most.

Some VPN apps request location access not because they want to track where you are but because Android ties certain WiFi related features to location permissions.

Features like automatically connecting on public WiFi may rely on this.

If the app doesn't explain why it needs location access, it's worth looking into before granting it.

Verdict: Sometimes legitimate, depending on the feature.

Files and Storage

Some VPN apps ask for storage access.

Possible reasons include:

• Exporting diagnostic logs
• Importing VPN configuration files
• Downloading certificates

If the VPN doesn't offer any features that involve files, this permission is worth questioning.

Verdict: Sometimes necessary.

Accessibility Permission

This is one permission I'd be much more cautious about.

Accessibility access gives apps broad control over parts of your device. Most VPNs don't need it for normal operation.

If a VPN requests Accessibility without clearly explaining why, I'd want a very good reason before enabling it.

Verdict: Investigate before allowing.

Contacts, Photos, Camera or Microphone

For a standard VPN service, these permissions usually aren't necessary.

There can be exceptions for example, scanning a QR code to import a configuration or attaching screenshots to a support ticket but they shouldn't be required just to use the VPN.

If a VPN insists on these permissions without explaining why, I'd be skeptical.

Verdict: Generally unnecessary for core VPN functionality.

Permissions vary depending on the platform

You might notice that the same VPN asks for different permissions on different devices.

For example:

• Android tends to expose more individual permissions.
• iOS keeps many permissions more tightly controlled by the operating system.
• Windows and macOS usually rely more on system level networking permissions than app specific prompts.

So don't be surprised if the Android version requests more permissions than the iPhone version.

A few good habits

Whenever I install a new VPN, I usually check these things:

• Read the explanation before granting any permission.
• Only enable optional permissions if I actually plan to use the related feature.
• Review permissions again after major app updates.
• Download VPN apps only from official app stores or the provider's website.
• If a permission seems unrelated to networking or security, look for an explanation before approving it.

Should you worry?

In most cases, no.

A reputable VPN needs certain permissions to create a secure tunnel and manage your connection. That's completely expected.

The bigger concern isn't that a VPN asks for permissions, it's whether those permissions make sense for the features the app provides and whether the provider is transparent about why they're needed.

If an app requests broad access without any explanation, that's usually a better reason to pause than the permission itself.

With excitement around GTA 6 continuing to build, cybersecurity researchers are warning that scammers are taking advantage of the hype by creating fake websites that promise early access, beta invitations or exclusive versions of the game.

According to recent reports, some of these sites look surprisingly convincing using AI generated artwork and GTA themed branding to appear legitimate. Victims are then asked to pay in cryptocurrency often hundreds of dollars for supposed early access or special editions that don't actually exist. Instead of getting the game, many users end up receiving nothing or are tricked into downloading malware.

Researchers also found fake PS5 and Xbox beta offers, malicious PC downloads disguised as updates and counterfeit mobile apps designed to display ads or install unwanted software. In some cases, the scams are aimed at stealing login credentials or other sensitive information.

The warning comes down to one simple point, if a website claims to offer unofficial GTA 6 access in exchange for crypto or asks you to download files from an unknown source, it's almost certainly a scam.

With one of the biggest game launches in years on the horizon, it's probably worth being extra cautious and relying only on official announcements and trusted storefronts.

An interesting privacy related warning came out this week from the CEO of Windscribe.

The message wasn't about VPN protocols or encryption, it was about the seemingly harmless quizzes that constantly circulate on Facebook and other social media platforms. According to the warning, these quizzes can encourage users to reveal personal information that could later be useful for identity theft, phishing attempts or even answering security questions tied to financial accounts.

Examples include quizzes asking for:

• Your first pet's name
• The street you grew up on
• Your birth month or hometown
• Favorite teachers, schools or childhood memories

Individually those questions might seem harmless. But when combined with information already available online, they can help build a surprisingly detailed profile of a person.

It also serves as a reminder that while VPNs help protect your connection and hide your IP address, they can't prevent someone from voluntarily sharing sensitive information on websites or social media.

The biggest privacy risk isn't always a technical vulnerability, it can simply be oversharing.

Has anyone else noticed how many of these quizzes resemble common account recovery or security questions? It definitely made me think twice before clicking on them.