Who actually makes VPN providers block sites? Three countries: France by court order, Spain by precautionary court measure, Italy by regulator rules. Everywhere else, orders stop at ISPs, DNS resolvers or search engines. Every obligation lands on a company, none on the user.

The PHP patch is out, but the hard part lands on tired people: 48% of security professionals feel exhausted trying to stay current on threats (ISC2), and about a third of PHP sites run version 7 or 5, end-of-life branches. PHP 7.3 and older get no fix from the PHP project.

We sell VPNs, and here is a thing a VPN will not do: protect your kids online. It filters nothing and reports nothing. Ofcom found a quarter of UK children aged 11 to 17 used one within six months of the age checks. So we mapped what each protection layer really does.

One week in October: a critical Linux VM escape, a CA with recoverable private keys, backup-wiping ransomware, two critical PHP flaws. Separate confirmed from feared: no PwnEscape exploitation is confirmed. The same exhausted people patch it all.

⚠️ PHP released 8.5.12, 8.4.27, 8.3.36 and 8.2.35. They fix CVE-2026-109618 and CVE-2026-109619 (CVSS 9.2), which can allow unauthenticated remote code execution. PHP reports no attacks in the wild. If you run PHP on a web server, update now.

5G solved the radio problem: traffic to the tower is encrypted and your subscriber ID stays off the air. It solved nothing above that. Your carrier still sees every DNS query and every destination, and a quiet downgrade to 4G or 2G brings the old attacks back. A VPN covers both.

Revolut card refused at the pump on Tuesday 20 October? The failure was at the issuer, not Visa and not the shop. A source quoted by Reuters links it to a Google Cloud outage in London. Google cites a power event in one zone; Revolut names no cause.

In late September someone stole three countries' domain registries and got real HTTPS certificates for Google domains. The padlock was valid. The sites were fake. What saved users was a paper trail most people have never heard of: Certificate Transparency.

The viral line that Russia now blocks VPNs with AI at 95 percent accuracy is not what Kommersant reported on 16 October 2026. The 95 percent was a proposed target in one draft of the national AI plan to 2030. The ministry says the current draft has no such provision.

Every outage brings the same advice: just turn on a VPN. We tested it against 14 outages since 2022. Rogers, Optus and AT&T were dead access lines; nothing tunnels through a line that is down. AWS and Cloudflare took the destination itself. The cases where it works are narrower.