You build a VPN tunnel so your location is nobody's business. As of yesterday in Utah, your location is the platform's business by law, regardless of the tunnel. The bill is Senate Bill 73. Governor Cox signed it on March 19. It took effect May 6. The law effectively bans the VPN by making the website liable for the age of every user physically located in Utah, regardless of the tunnel they routed through, and then forbids the website from explaining how a VPN works. This is liability for what the platform cannot see. A speech ban on naming a legal tool. The only compliant move is to ID every visitor on Earth, in case one of them happens to be in Provo. Or block every known VPN IP address and pray the list is complete. NordVPN says comprehensive blocking of VPN traffic is technically impossible. The EFF says no platform can win this whack-a-mole. Utah's legislature does not care, because compliance was never the point. The point was making encrypted tunnels expensive to deploy and illegal to discuss. The point was driving commercial VPN providers out of the American market until the only people left with private connections are the ones who can stand up their own WireGuard server. Children is the cover, of course. A legislature punished platforms for what they cannot detect, gagged them from naming a tool that has been legal since the day it was invented, and stamped "child safety" on the file. This is the first state. The UK House of Lords already voted 207 to 159 to ban VPNs for minors. France's digital affairs minister has named VPNs as her next target. The fence moves next session, next state, next chamber. Each version will be sold as safety. Each version will be a muzzle.

Virtual private networks #VPN# are increasingly used to bypass online age verification. Protecting children online is a priority, with new rules being implemented requiring a minimum age for access to some services Read👉 #DSA# @EP_Justice @FZarzalejos

Palo Alto Networks says attackers are actively exploiting a GlobalProtect VPN vulnerability known as CVE-2026-0257. The bug affects certain GlobalProtect portal and gateway setups and lets attackers connect to a VPN without the usual login and authentication checks. Since GlobalProtect is typically exposed to the internet, a successful attack could give cybercriminals access to an organization’s internal network. Security researchers have already observed real-world attacks targeting vulnerable systems. If your organization uses GlobalProtect, check whether you are affected and install the latest security updates. Palo Alto Networks has released fixes for supported PAN-OS versions and urges customers to update as soon as possible. Security teams should also monitor VPN logs and investigate any unusual login activity or unexpected VPN connections.

Vladimir Putin has signed a new law that increases restrictions on VPN services in Russia. VPNs are often used to access blocked websites and protect online privacy. Russia has regulated VPNs for several years, but the new measures give authorities stronger control over internet access and censorship. The government says the law aims to improve cybersecurity and protect national stability, but peopple say is just another step toward tighter control of information and reduced internet freedom. Russia is expanding its “sovereign internet” system, which allows closer monitoring and filtering of online traffic. As a result, many VPN services have become slower, blocked, or unreliable.

Law enforcement from 27 countries seized the First VPN Service, also known as 1VPNS, in Operation Saffron. A total of 33 servers associated with the infrastructure were taken down. The service provided various VPN configurations, including single, double, and multi-hop options, and was reportedly used by cybercriminals. The official website now displays a law enforcement takeover banner. A press release detailing the operation is expected soon.