u/EducatorHonest1161

The starting point for the creation of Psiphon was the University of Toronto, where researchers created it in support of people under oppressive regimes. Now, it is used by around 20 million people. Yet, it seems Canada’s government might create the conditions for it to leave Canada.

The bill known as Bill C-22, or Canada’s Lawful Access Act, ensures that providers build surveillance mechanisms into their systems. Psiphon was correct to say that the passing of the law would lead to “the transformation of the service.” Psiphon might stop operating in Canada if the law passes without any adjustments.

The most unpleasant thing about this situation is that Psiphon positions the service as “the service that won’t be able to be compromised by your government.” If Canada forces this compromise through the law, it will make Psiphon’s position weaker.

For me it's when it turns itself on without me asking and some app just quietly stops working. No error message, nothing obvious, it just breaks. And I'll spend like 5 minutes trying to figure out what's wrong before it even occurs to me to check if my VPN auto-connected in the background.

Does this happen to anyone else or is it just me. What's yours, the thing that's annoying enough to bug you every time but not quite enough to make you switch providers?

This month, the US embassy in Canberra formally opposed Australia's proposed Digital Duty of Care legislation, saying vague definitions of harm put in place by the eSafety Commissioner could lead to "viewpoint censorship" and the requirement for algorithms to be designed in a specific way could create problems for users outside Australia.

But it gets even more interesting: PM Albanese confronted the Assembly head-on, stating that the intent of the law is not to provide the government with control over content but putting the power in the hands of individuals. This leads to two governments being publicly on record regarding their differing opinions on the line between "user protection" and "the regulation of what they see."

This comes as Australia's eSafety Commissioner is already under scrutiny for taking the path of using VPNs after adult-site age verification has been easily bypassed. The US embassy taking this position does not fall under the category of common diplomatic chatter; rather, it indicates serious disputes about the implications of "mandated algorithms."

It will be interesting to see whether the matter is resolved diplomatically or if it leads to amendments to the bill.

On September 21, EFF released an extensive evaluation of the EU Kids Act, a concept concerning a three-tiered system that extends to almost all popular electronic outlets. One of the less talked about elements: when a parent seeks to give permission for a child between the ages of 13 and 15 to access the Internet, this parent must prove both his or her identity and that of his or her child in order to assess the child's age.

However, what is more intriguing here is that the purpose of EFF's opposition is not about children at all, but rather, it concerns the structure. Age requirements have the effect of creating a structure of power in a few major technology companies, prejudice against underprivileged data groups, and transitioning from the point of safety to the stipulation of the requirements regarding the production of content.

It has become a pattern in recent events: a law is accepted, people find ways to avoid obeying it, and a countering bill is proposed to fill the gaps left by the previous law. The examples include Utah, Brazil, and Michigan.

Surfshark has published a comprehensive report on a security incident that took place at the start of September, when an internal testing server was incorrectly configured and became publicly available to unauthorized users.

What was leaked is strictly related to internal engineering documents, binaries, and configurations, meaning no users’ information was compromised. The fact that personal data has not been in danger here is not only a matter of reassurance, but also the matter of structural nature: no user information has ever been stored on the server, and customer traffic has never been logged, which means that nothing sensitive was available for leaks.

Now, let’s compare this case with a recent data breach at NotVPN, where the provider’s statement “we do not log connections” turned out to be false as soon as the exposed database was checked. In case with Surfshark, their explanation corresponds with what has been leaked in reality.

Europe’s ISPs tell the EU: Rightsholders should pay when piracy blocking takes down legitimate sites.

EuroISPA has filed a petition with the European Commission, pointing out that it’s the right owners and not ISPs, DNS providers, or VPNs, who should bear the financial responsibility when piracy blocking directives close legitimate sites down.

The evidence speaks for itself: Italy's Piracy Shield caused collateral damage to more than 7,700 domain names, in one case, plus an email service of a Portuguese hosting provider became inoperative for 16 days. La Liga of Spain obtained a court order concerning some shared IP addresses used to host several legitimate websites. Cloudflare refused to obey one of the requests for blocking, however, the Italian regulatory authority fined this company for €14 million.

EuroISPA's actual ask is simple: right owners should be responsible for making unnecessary blockings in order to stop piracy, using the means stipulated in EU legislation.

In other words, the organization that is cleaning the mess caused by incorrect blocking requests wants to make their initiators pay for their blunders.

Earlier this month, Senator Ron Wyden sent a letter to NSA Director Gen. Joshua Rudd, requesting that the agency change its guidance to the public since standard commercial VPNs “do not adequately safeguard users from sophisticated adversaries.”

The concept is practically uncomplicated when you grasp it: foreign intelligence does not even need to crack your VPN's encryption. What they can do instead is observe the timing and volume of the information that goes into the VPN server and compare that with the data that comes out. When they find a close match, it becomes possible to tie an individual to a website without being able to decipher any encrypted information. This process works only for a “single-hop” VPN, which is the type of VPN that most of the people use where all the traffic gets routed through a single server that can be accessed by the opponent.

Here's the irony that needs consideration: federal agencies spent years informing the American citizens about the importance of a VPN for attaining a level of privacy. Wyden's letter is actually saying that this may be true for an average user but not when it comes to someone being targeted, the journalists, the defense contractors, and the human rights advocates, exactly the people the advice is meant for. In this context, he raised the question of whether the NSA must be redirecting higher-risk individuals to multi-hop systems like Tor or Nym.

The NSA has to provide its answer by October 14. Remember this next time "just use a VPN" is suggested.

SonicWall announced two new security vulnerabilities in SMA 1000 devices on September 1—CVE-2026-83548, which has a severity score of 10.0, and CVE-2026-83549 that has the severity of 7.8. By combining both vulnerabilities, cybercriminal can execute their code on devices remotely without authenticating themselves. The company has found these vulnerabilities in its own environment and confirmed they are being exploited.

These are the third zero-day vulnerabilities in SMA 1000 series devices in less than a year. In July, an attack was reported in which an attacker stole MFA seeds, which are still usable by the attacker. Thus, the patch applies but does not help with the previous theft of the MFA seeds. Cybersecurity and Infrastructure Security Agency told federal agencies they have four days to patch their systems.

Just because systems have been patched doesn’t mean that vulnerabilities were removed. Cybercriminals are still in possession of stolen MFA seeds from earlier attacks.

Three chains against the same product line in twelve months is a pattern. Credential rotation has to be part of the conversation now, not just patching.

France's constitutional council rejected the ban on under-15s on social media on August 14. The law should have made France the first EU member state to prohibit children from using social media. President Macron has already requested that the law be re-drafted, so that it is ready by summer 2027.

The ruling focused on the major problem with the proposed law: in order to ban under-15s "a person has to prove their age," since there is no way to determine age without checking each individual. Furthermore, the court pointed out that the law, as it is written, gives no consideration to the specific platforms used and doesn't differentiate between the individual readiness of children to use it.

EFF connected this decision to the larger issue at hand, indicating that such bans "are assaulting rights for privacy and anonymity on web;" Australian version of the law served as the role model for France's legislation and demonstrated that the age checks can be incorrect.

In short, while this may be the first case in the EU, Denmark is also working on anti-children law.

Garcia, a resident of California, has taken legal action against Surfshark, claiming that the company had been signing him up for auto-renewal plans without seeking his consent for four consecutive years. He had purchased a two-year subscription in May of 2020, believing it to be a single payment, but he was charged again in 2022, 2023, and again in 2024, without ever being notified of the renewals.

The legal case is straightforward: under California's Auto-Renewal law, it is required to inform the customer of renewals in a clear manner and obtain their consent to subscribe them to auto-renewals. The lawsuit claims that neither of these took place and calls for the refunds of the renewals.

This legal complaint is not unique. The company NordVPN, has faced five lawsuits of a similar nature since 2024 for very similar reasons. Surfshark is now facing the same challenges, just under a different name.

Three different VPN companies facing similar lawsuits, it can be useful for customers to keep track of their renewal dates irrespective of the provider.

As of July 1, Vietnam has implemented a new law that penalizes individuals for spreading false or slanderous material through social media sites. The fines can be between twenty million and thirty million VND which is equivalent to anywhere between $794 and $1,190 for spreading material that can tarnish the reputation of an individual or agency in the state.

As soon as the law was announced, Proton VPN has seen an increase in the number of sign-ups since a person in the Lào Cai province of Vietnam was charged 2.5 million VND for making inappropriate remarks about the police via Facebook. The nation began to realize that factual laws mean an individual can be charged for his or her comments.

While the nation was passing its laws forbidding the prevention of the free speech, it created a local version of Roblox which was launched on August 13. The new version blocks 80% of the games, disables chat and limits the number of hours of play to only three.

In June 2023, the CEO of Windscribe, Yegor Sak, was charged with illegal access to electronic data in Greece when it was revealed that someone used a Windscribe server in Finland to commit a cybercrime. Greek authorities did not issue a subpoena to Windscribe but charged Sak personally since he was the one whose name was listed on the server bill.

Eventually, Athens court dismissed the case on April 11th, 2025, two years later because of lack of proof. Sak’s comments were: “Some idiot decided to use our VPN to do some idiotic things…there are no logs regarding anything.”

Sak’s comments speak volumes since: “This is a worrying precedent…if upheld, this could make owning infrastructure a criminal offence due to actions of some anonymous persons.”

On August 21, 2023, Microsoft made known a vulnerability identified as CVE-2026-69836. This vulnerability is a deserialization error in Entra ID, which is an identity service that many enterprises use and apply for establishing their VPN and remote access logins. Its Confidentiality, Integrity, and Availability (CIA) rating is 10, the highest potential score.

What’s interesting to note is that Microsoft discovered this vulnerability by itself, which means that internally the company managed to resolve the issue before announcing it to the public, so no patches or administration activities were required. First, the security advisory stated that this vulnerability had been proof of concept in the wild, however, three days later the announcement was withdrawn. It is worthwhile thinking about the implications of the two statements made in this advisory; an extreme vulnerability is quietly hiding in the identity infrastructure of remote access for organizations.

According to a report by the Legal Affairs Committee of the European Parliament, it is now suggested that there should be a mandatory requirement for takedown of any illegal sports streams within thirty minutes of receiving complaints regarding such streams. This covers all VPNs, DNS resolvers, ISPs, and CDNs which would have to comply with blocking notices in real time whenever an IP rights owner claims of illegal streaming.

Why is this report remarkable? It follows the CJEU decision in the case of Anne Frank's case which declared that VPNs are "lawful technical tools" that cannot be held liable for what any user bypasses. The conclusion of Professor Giovanni Maria Riccio's report points to the fact that the current voluntary approach within the EU fails to work and suggests something similar to Italy's Piracy Shield that would be legally binding, rapid, and automatic.

The risk lies in the mechanism and not in what sports piracy has struck as its target: real-time IP and DNS blocking is not entirely accurate; one pirate stream can be hosted on an IP address that is shared with thousands of other legitimate entities that go extinct with that address in a span of ten minutes without any time for checking.

So, one rule of the EU states VPNs are not liable for what users do, but another is busy putting forwards a theory that would compel them to do the policing job, too. The question is which one will win out, depending on how fierce the pushback is before the law comes into force.

This week, Windscribe shared a video with an artificial intelligence-generated Adolf Hitler on its official X account to respond to the criticisms leveled by TechRadar toward its CEO Yegor Sak regarding the act, saying that the video was intended to make fun of both authoritarianism and censorship. Unfortunately, the video had the opposite effect. Privacy advocates and customers reacted to the video and called it what it really was, and Reddit threads against the ad received hundreds of thousands of comments and upvotes soon after the video was released.

As the situation develops, screenshots from the same account show that Windscribe is sharing information about how it uses artificial intelligence in its operations. It is worth mentioning that the company claims that it relies on artificial intelligence for customer service, developing codes, and carrying out testing. For a business that is selling services aiming at securing users' data, having the information about its services being offered by artificial intelligence is definitely sending contradictory messages.

Windscribe wasn't new letting controversies follow in its steps, as it has been in limelight for its infamous donation campaign and "dickbutt CAPTCHA." However, this time the consequences are serious.

On August 12, Brazil's data protection authority directed Discord to suspend the video calling and live streaming functions in the country after it found that a 13-year-old girl committed suicide during a live call on the platform. Discord obeyed the government edict and made changes on August 17, while the text messaging and voice options keep working.

The GM of Proton VPN named David Peterson states that after Brazil's ban an increase in registrations by around 800% was witnessed, while the company usually blames the increase on censorship. Unlike the other instances this ban comes because Discord was unable to prevent torrenting of self-harming materials rather than unavailability in a certain country or territory.

Moreover, there may be some serious legal implications that come with using VPN, with the Senate bill suggesting a fine and prison term of 1 to 3 years for those using it. However, the bill provides for legitimate usages of the technology by business entities.

So people upset about having no screen-sharing options anymore are finding themselves downloading a tool that helps bypass the ban, which may offer jail time for them as well. Quite a challenging issue arose with the new ruling. If this affects you or someone you know, Brazil's CVV (188) offers free crisis support.

Reviewing all known cases of VPNs having legal action initiated in China between January and June 2026 reveals a different understanding of how the processes really work. People think that the key factor when being caught is the firewall system recording the violation, but it's actually working quite differently.

Path one: unknowingly having the phone checked for unrelated issues, be it a legal case, or a fraud report. The VPN being there might be the reason for being apprehended. Path two: people being slow-caught by technology. There was a leak of university internal ID system manual, which can notify the admin automatically, complete with timestamps and the offenders' IP addresses.

The amount of fines varies greatly: 200 yuan in Ezhou and the maximum of 15,000 yuan in Nanchang, as well as the 15 days of arrest for a person selling devices in Zhongshan. The law provides for the maximum of 15,000 yuan mostly in the cases when warnings are given under the law.

Microsoft's August Patch Tuesday included a total of 415 vulnerabilities fixed, with two related to essential aspects of VPN infrastructure. CVE-2026-62819 is a use-after-free vulnerability affecting Windows routing and remote access service (RRAS), which many companies use to set up their VPN and link locations. An attacker could exploit this vulnerability to execute the code of the system remotely due to a successful race condition.

The second vulnerability, CVE-2026-62889, affects Secure Socket Tunneling Protocol (SSTP), the using SSL/TLS tunneling protocol for VPN networks. Both vulnerabilities have a CVSS score of 8.1.

The Importance of Fixing Those Vulnerabilities: While these may seem to be unusual bugs, RRAS and SSTP are two integral parts of many companies’ "just use the built-in Windows VPN" approach. If you're operating a Windows server VPN gateway, this patch is not optional.

In the recent announcement, Microsoft described the end of the technology known as Manifest V2 from the previous versions of Edge browsers. Starting from August 2023, the old extensions built using Manifest V2 will be disabled by default. The technology will end completely by the end of 2026.

This situation with Manifest V2 can lead to the disappearance of the traditional version of uBlock Origin which is not affected by Manifest V3. Manifest V3 limits the number of filtering rules to 30000 items and removes the network access that ad blockers require to track and deny advertisements before they are loaded. The author of the original uBlock Origin called the implementation of Manifest V3 a crime against the ad blocking industry.

Microsoft attempts to present it as an improvement from the viewpoint of security. However, EFF claims MV3 to be a backdoor in favor of advertisement companies. Chrome had a similar experience in 2025 and Microsoft is simply following the path of Chromium technologies.

As a result of this, two of the largest web browsers in the world are now discontinuing the feature that uses technology to prevent tracking from occurring, rather than merely blocking ads. Firefox and Brave, however, are not embracing this trend. It's good to be aware of it before your own add-ons are discarded without warning.

This week, ETSI published EN 304 620, the first recognized cybersecurity standard for VPNs under the EU's Cyber Resilience Act. Previously, any provider could assert that its encryption was "military-level" without any evidence to validate it.

The most interesting part is that NordVPN (representing Nord Security) and Surfshark played a part in creating it together with Palo Alto Networks, Cisco, Google, and Airbus, with Miguel Fornés from Surfshark being directly involved in parts of its drafting.

The standard will be available in the public domain this month while the enforcement date is scheduled on December 11, 2027 and violations will incur fines of up to €15 million or 2.5% of the annual turnover.

It looks like there’s a real progress when it comes to having VPNs validate their security claims rather than just market them, however, we should also take into consideration the fact that VPN companies participated in drafting their test as well.

What do you think? Would anything actually change by 2027?