VPNs are widely known for their benefits, including preventing location-based overcharging, safeguarding online privacy, and enabling access to geographically restricted content like foreign Netflix libraries. Historically, VPNs have been considered safe, but a new investigation by Top10VPN challenges this assumption.

Collaborating with security researcher Mathy Vanhoef, Top10VPN uncovered critical vulnerabilities impacting over 4 million systems. These include VPN servers, home routers, mobile servers, and CDN nodes, with high-profile companies like Meta and Tencent among those affected. The findings, set to be presented at the USENIX 2025 conference in Seattle, highlight flaws in key protocols—IP6IP6, GRE6, 4in6, and 6in4—designed to secure data transmission.

According to the research, these protocols fail to ensure sender identity matches the authorized VPN user profile. This weakness allows attackers to exploit one-way proxies, repeatedly gaining unauthorized access undetected. By sending data packets using compromised protocols, hackers can launch denial-of-service (DoS) attacks or infiltrate private networks to steal sensitive information.

To mitigate these risks, experts recommend additional security mechanisms like IPsec or WireGuard, which ensure end-to-end encryption. These tools limit the ability to access VPN traffic data, decryptable only by the designated server.

The investigation revealed that VPN services and servers deemed insecure were concentrated in the US, Brazil, China, France, and Japan. Users are advised to select VPNs that incorporate robust encryption methods and to remain cautious when using such services. Independent testing of VPN security is essential for ensuring reliability and safety.

For those seeking trusted options, refer to independent reviews and comparisons of the best VPN services, which prioritize user security and encryption protocols.