Regulation
Spanish football league LaLiga filed a 14-page submission dated September 10, 2026 asking the European Commission to add NordVPN, Proton VPN, ExpressVPN and Surfshark to the 2027 Counterfeit and Piracy Watch List. The filing entered the Commission public consultation that ran from June 11 to September 21, 2026. LaLiga states the request targets deliberate marketing and affiliate promotion of circumvention of court-ordered blocking measures, not the provision of VPN services as such. Earlier, on February 17, 2026, Commercial Court No. 1 of Córdoba granted ex parte precautionary measures against NordVPN and Proton VPN requiring them to make claimant-supplied IP addresses inaccessible from Spain; in May the same court declined coercive fines against NordVPN while main proceedings continue.
If you use a named brand in Spain or the EU, watch whether affiliate-facing 'unblock sports' messaging changes and whether Spanish IP blocks expand; the Commission list is due in Q2 2027 and is not itself a legal ban.
Via BetaNews
Separately from this week's EU watch-list push, reporting on July 3, 2026 said the Indian government is preparing a broader legal framework for VPN providers after CERT-In's April 2022 directions—which require five-year retention of subscriber names, contacts and allocated IP addresses—failed to secure compliance from major no-logs brands. Officials discussed requirements for a local India office, designated compliance officers, and possible jail terms for local employees, echoing elements of the IT Rules, 2021. Proton VPN, NordVPN, ExpressVPN and Surfshark had already removed physical Indian servers and route India traffic through locations such as Singapore rather than store the mandated IDs.
Buyers in India should prefer providers that publicly document jurisdiction, logging, and how Indian traffic is routed, and should assume local-presence rules may return with sharper teeth than the 2022 directions.
Internet security
On October 6, 2026 the U.S. Federal Bureau of Investigation and the United States Secret Service published joint cybersecurity advisory JCSA-20261006-01 on FortiBleed, an active credential-compromise campaign against internet-facing Fortinet FortiGate firewalls and SSL VPN gateways. SOCRadar has verified more than 86,644 compromised devices across 194 countries. Attackers reuse leaked credentials, stuff and spray passwords, crack legacy SHA-256 admin hashes offline with Hashcat and Hashtopolis, create new admin accounts, and in some cases delete or change existing admin passwords so legitimate operators are locked out. The FortiBleed chain has been observed as an initial-access path for ransomware affiliates including INC/Lynx and Payload.
Enterprise and self-hosted SSL VPN admins should remove internet management where possible, terminate all admin and VPN sessions, reset credentials, enforce phishing-resistant MFA, switch admin password storage to PBKDF2, and hunt for unrecognized FortiGate accounts.
Via FBI IC3 / USSS JCSA-20261006-01
Vendors
On October 7, 2026 Surfshark announced that its WireGuard implementation is now fully post-quantum secure on iOS and macOS, adding ML-DSA for authentication on top of earlier ML-KEM post-quantum key exchange. The company says both NIST lattice-based standards are required to close steal-now-decrypt-later and future real-time quantum threats against handshake and server authentication. The same dual-standard approach powers Surfshark's custom Dausos protocol on macOS, with additional platforms planned for the post-quantum WireGuard rollout.
If post-quantum handshakes matter to you, confirm the feature is enabled on your OS build and do not assume Android, Windows or Linux clients have shipped the same dual ML-KEM plus ML-DSA stack yet.
Via Surfshark blog
Mullvad announced on September 3, 2026 that it will shut down its public encrypted DNS-over-HTTPS servers and instead financially support the Quad9 Foundation. Mullvad Browser users on default DoH settings will be migrated automatically; anyone who manually configured Mullvad DoH must switch before November 2, 2026, and existing iOS and macOS Mullvad DoH configuration profiles will stop working and need Quad9 replacements. Mullvad stresses that traffic inside Mullvad VPN already uses the provider's internal DNS, so the public DoH service was mainly for browser and non-VPN use.
Before November 2, replace any manual Mullvad DoH endpoints and Apple configuration profiles with Quad9; VPN-tunnel users are unaffected for in-tunnel DNS.
Via Mullvad blog
VPN technology
The OpenVPN community project released OpenVPN 2.7.8 on October 7, 2026 as a security-focused bugfix. Fixes include refusing certificates with NULL bytes in subjects (CVE-2026-84790), correcting an unsigned underflow when clearing domain_search_list (CVE-2026-88964), and stopping cmd.exe variable expansion in quoted Windows arguments (CVE-2026-84256). The bundled ovpn-dco-win driver update to v2.8.13 addresses CVE-2026-105390, a local locking flaw that could deadlock a host. Earlier in the same release train, OpenVPN 2.7.7 on September 3 fixed CVE-2026-84732, a reliability-layer denial-of-service via unbounded TLS retransmission timeouts and acknowledgements for non-outstanding packets, affecting 2.6.22 and 2.7.6.
Self-hosted and appliance OpenVPN deployments should move to 2.7.8 or the matching 2.6.23 line promptly, especially Windows MSI installs that ship the dco-win driver.
Via OpenVPN community ReleaseHistory
Forums
On October 9, 2026 the Tor Project published a community statement explaining that it will continue its narrowly scoped technical collaboration with Mullvad after internal due diligence that included community discussions, a staff survey, board review and financial scenario planning. Tor said recent concerns about a political donation by a Mullvad co-founder prompted calls to end the relationship. The Project is pausing proactive co-branding, clarifying how Mullvad Browser is described on Tor-owned channels, and stressing that collaboration must serve Tor's human-rights mission without implying broader values endorsement.
Treat Mullvad Browser and Tor Browser as related but separately governed products; do not read joint technical work as a blanket endorsement after Tor's co-branding pause.
Via Tor Project blog