Hackers Exploit Gladinet Zero-Day As Arizona’s Age-Check Law Causes VPN Surge

How often do you stop and think about what keeps the digital ecosystem running?

We bet, it’s not that often. We’re always online; from sending files, signing in, scrolling endlessly, and ChatGPT-ing day-to-day concerns, until the systems behind it hits a snag.

Then comes the real revelation… the moment you realize that something like a software exploit or a new regulation can affect the way you work, share, or even browse. It’s that sudden reminder that the invisible gears of the internet—security, privacy, and access—are always moving, even when we’re not paying attention.

Something similar is happening in this digital world right now, as cybersecurity headlines are coming thick and fast as a reminder that we inhabit a constantly shifting digital world.

From threat actors actively exploiting a zero-day flaw to Arizona’s newly enacted age verification law driving a surge in VPN demand, here are the top headlines affecting how we view security, privacy, and cyber risks.

Let’s dig in!
 

What’s Happening With Gladinet?

Hackers are exploiting CVE-2025-11371, a Local File Inclusion (LFI) vulnerability in Gladinet’s CentreStack and Triofox products, letting unauthenticated attackers read sensitive system files.

All versions—including the latest release (16.7.10368.56560)—are affected in default configurations. The exploit chain works by reading the Web.config file to extract the machine key, then combining that with a previously known deserialization bug (CVE-2025-30406) to achieve remote code execution (RCE), as explained by ViewState.

In September 2025, Huntress researchers observed this real-world exploitation and alerted Gladinet. The American cloud collaboration giant even confirmed the issue and is working on a patch.

Until then, mitigations are being shared with affected customers, including removing the temp handler line pointing to t.dn, which is the LFI entry point.


This may degrade some functionality, but it successfully blocks the exploit. However, researchers warned organizations to rotate keys and monitor for unusual activity, as this vulnerability substantially increases the attack surface for file sharing environments.

The scale and structure of the cyber-attack reveals why even seemingly minor flaws can escalate into critical breaches when chained together.

CentreStack and Triofox are used by clients to transform their own storage into a cloud-like file sharing or remote access environment, essentially replacing third-party cloud or VPN services.

That’s because they often sit exposed to web or network interfaces, the successful exploitation of which can lead to full server compromise.

In this case, the chaining of two vulnerabilities (LFI + deserialization) shows how legacy issues (that is, hardcoded keys) can be revived to exploit configuration errors. Plus, the lack of a quick patch means defenders must mitigate proactively or risk server compromise.

Researchers analyzing the incident have emphasized the underlying mechanics and scope of exploitation to provide better visibility into the threat.
 

What Did The Experts Say?

The Huntress team explained: “After subsequent analysis, Huntress discovered exploitation of an unauthenticated local file inclusion vulnerability (CVE-2025-11371) that allowed a threat actor to retrieve the machine key from the application Web.config file to perform remote code execution via the aforementioned ViewState deserialization vulnerability.”

Gladinet has confirmed the vulnerability and is actively notifying customers and coordinating the release of a patch.

As enterprises work to contain software exploits, individuals in the U.S. are navigating a different kind of digital exposure—this time through legislative change.
 

What’s Happening in Arizona’s VPN Market?

On September 26, 2025, Arizona’s new age verification law came into effect, requiring users to verify their age via government or digital IDs to access content in certain categories.

In the days before and after implementation, Arizona led all U.S. states in Google Trends search interest for “VPN,” surpassing the next highest state by a wide margin.


Searches rose sharply just before the law took effect, peaking on September 27, then dipping slightly, and rising again in late September.

Proton VPN reported a ~450% increase in signups in Arizona compared to its baseline U.S. activity, with rising search terms including “Proton VPN download,” “VPN for Safari,” “is NordVPN free,” “best VPN,” and “iPhone VPN.”

In Ohio, where a similar law began on September 30, authorities also saw rising VPN interest—though nowhere near Arizona’s level.

The state of Missouri has laws pending implementation (effective November 30) and has already seen some VPN interest. Michigan is considering a total VPN ban via a proposed “Anticorruption of Public Morals Act,” which, if passed, would outlaw circumvention tools and penalize promoters heavily.

While these developments differ in context and security threat, they converge on a central theme: the ongoing struggle to balance accessibility with compliance in a hyperconnected world.

As enterprises shift toward self-hosted file access, the attack surface is expanding for attackers. Meanwhile, individuals turn to VPNs when digital freedom is being limited.

The tension between regulation, privacy, and security is playing out at both macro (state law) and micro (server configuration) levels. Plus, both incidents involve control over information access—on enterprise servers (Gladinet) and for consumers browsing the web (Arizona).

When platforms or laws impose restrictions, attackers respond via exploitation, and consumers by adopting privacy tools.
 

What Cyber Risks Do These Events Highlight?

The Gladinet zero-day exposes the dangers of unpatched vulnerabilities and how chained exploits can turn local flaws into full system compromises. The incident underscores the growing risks of misconfiguration in enterprise file-sharing platforms that handle sensitive data.

The VPN surge in Arizona, following Ohio, reflects public concern over data collection and privacy exposure resulting from mandatory digital identification measures. The rising policy-driven internet restrictions and the exploitation of enterprise software flaws highlight the broader connection between privacy and access control.

Do you think Gladinet’s mitigations and upcoming patch can contain the exploit and gain back clients’ trust? Will Arizona’s age law meaningfully protect minors without eroding citizens’ right to digital privacy?

Let us know in the comments below!