ExpressVPN bug has been leaking some DNS requests for years
www.bleepingcomputer.com
ExpressVPN has removed the split tunneling feature from the latest version of its software after finding that a bug exposed the domains users were visiting to configured DNS servers.

Bug:

Affected versions 12.23.1-12.72.0 (May 2022-Feb 2024) with split tunneling feature.

Impact:

Exposed visited domains to user’s ISP, potentially leaking browsing history.

Affected users:

Windows users with active split tunneling (about 1%).

Fix:

Upgrade to version 12.73.0 (removes split tunneling temporarily).

Alternatives:

Disable split tunneling or use ExpressVPN version 10.

Note:

All other traffic and content remain encrypted.

  • Lunch@lemmy.worldEnglish
    0·
    9 months ago

    From what I know they were perfectly aware of the situation but did little about it… So thats a red flag. But yeah, there is a lot more to this, and that one source doesn’t cover it all, and is another source that shills certain VPNs themselves, hence why I said its not a great source itself. I can edit in some additional sources that are worth reading regarding the case when I get home.

    But imo, there isn’t a single good reason to use ExpressVPN, instead of Mullvad, IVPN or ProtonVPN.