Fusion power is getting back to its roots. As fusion startups keep chasing their ultimate goal — putting electrons on the grid — many are also now embracing, or returning to, the defense applications that laid the foundation for the industry.

The sector emerged decades ago when physicists looked for more constructive uses of the science behind the thermonuclear bombs that proliferated during the Cold War. The national security angle never really went away. A groundbreaking fusion power experiment in 2022 happened at the National Ignition Facility, which has supported national security applications for more than 25 years.

That shift has accelerated as venture dollars committed to climate tech — the funds that typically have supported fusion startups — have stalled. Fusion startups have captured a large portion of recent climate tech funding, but fusion is an expensive business, and VCs are always happy when their portfolio companies find other sources of money.

That’s where the defense industry comes in. The defense industry has explored laser weapons for years, but interest has spiked as drones have reshaped modern warfare. Traditional air defense systems were designed to target human-piloted aircraft, which tend to be larger and fewer in number. That has led to some comical mismatches between aggressor and defender. For example, about a decade ago, a U.S. ally used a $3 million Patriot missile to shoot down a $200 consumer drone. Effective, but not very efficient.

Laser weapons promise to alter the math. Instead of firing a single, expensive, one-use missile per shot, hey fire quickly and relatively cheaply, using electricity drawn from a generator or a ship’s reactor or engine.

Fusion startups working on laser-based reactor designs are ideal partners in developing such weapons. Last week, laser-based fusion startup Xcimer announced a partnership with and investment from RTX, the conglomerate that includes defense contractor Raytheon. Under the deal, Xcimer gets funding from RTX Ventures, while RTX can start exploring how to use Xcimer’s powerful lasers for its own purposes.

Denver-based Xcimer currently operates what it says is the largest privately owned laser system in the world, which it plans to use to develop a power plant. Inside its power plant, lasers will bombard fuel targets, compressing them until the atoms inside fuse and release energy. The startup’s current laser system, Phoenix, operates at an order of magnitude lower power than will be required for a power plant, but it is powerful enough to have caught the attention of the defense industry.

Xcimer isn’t the only player in the defense space. Pacific Fusion announced a memorandum of understanding last month with the National Nuclear Security Administration (NNSA) to work together on high-energy-density fusion experiments. 

The startup recently broke ground on a demonstration facility in New Mexico not far from the Sandia and Los Alamos National Laboratories. While its primary purpose is to demonstrate that the company’s design can generate more power than the facility consumes, it has other uses. The fusion reactions at Pacific Fusion’s facility will be far more powerful than those the government currently uses to perform nuclear weapons experiments.

“It turns out that the facility that we’re building also has utility in this world-leading defense application,” Keith LeChein, co-founder and chief technical officer at Pacific Fusion, told TechCrunch recently.

It might sound like a convenient coincidence, but it isn’t one. Defense applications were “always on our mind,” said Carrie von Muench, co-founder and chief operating officer at Pacific Fusion. LeChien, who developed the company’s core technology, previously worked at Sandia National Laboratories, the Lawrence Livermore National Laboratory, and the National Nuclear Security Administration.

Fusion power has come a long way since the first weapons scientists dreamt it up decades ago, but its national security applications haven’t been forgotten. Their recent reacquaintance is perhaps overdue, and promises to give willing fusion startups a helpful boost.

Apple has stuck to a familiar iPhone launch schedule for years, with its latest models typically arriving like clockwork every September. But this year, the regular iPhone 18 was nowhere to be seen. 

While some might be disappointed by the six-month delay, I think Apple made the right call. Not only does it give the long-awaited foldable iPhone more room to shine, but it also highlights an uncomfortable truth about modern smartphones: we probably don’t need a new one every 12 months.

Apple has broken tradition for the first time in years

September is known for one thing in the tech calendar: new iPhones. Apple has stuck to the same launch schedule for its iPhone collection for years at this point, a trend it kicked off back with the iPhone 4S. Yes, there have been a few slips here and there – it shifted to October in 2020 during the height of Covid, for example – but for the most part, flagship iPhones have launched in September.

But not this year.

Advertisement

Advertisement

For the first time ever, Apple decided against launching the base-level iPhone alongside its Pro-level siblings. We saw the iPhone 18 Pro and Pro Max, complete with the rumoured variable aperture on its main 48MP camera, big battery upgrades and boosted Apple A20 Pro power, but the regular iPhone 18 was a no-show.

Instead, the rumours suggest that Apple is holding off on launching the iPhone 18 for another six months, with plans to reveal it alongside the next-gen iPhone Air and the iPhone 18e at an event in Spring of 2027. 

It’ll likely appear sometime between March and May; while the flagship iPhone hasn’t launched in Spring before, Apple has used the window to launch other variants of iPhone – namely the budget-focused iPhone SE and iPhone ‘e’ models – and products like the iPad Pro and iPad Air.  

Blame the foldable iPhone

Of course, we know the real reason that Apple didn’t launch the iPhone 18 earlier this week – the iPhone Duo. Apple’s first foldable iPhone has been a long time coming, with rumours circulating for literally years at this point, and it had to be a big part of the September launch event. 

Advertisement

It makes sense too; this is the first time Apple has debuted a phone in this form factor, and it has done so years after much of the Android competition, so it needed to take more time to explain what makes it so special. 

Advertisement

While the segment for products like the Apple Watch Series 12 and Ultra 4 was over in a little over 12 minutes, Apple took around 25 minutes to showcase the foldable iPhone, from hardware elements like the hinge, dual-cell battery design, screens and cameras, to small software additions that really elevate the foldable experience on the whole. 

Now there is an argument that Apple could’ve simply extended the event to make room for the iPhone 18, and that is true, but I imagine there were fears from Apple execs that it’d simply get lost in the shuffle with the more advanced (and more exciting) Pro and Duo models. 

It’s clear that those models would get most attention from attendees, media and likely diehard Apple fans, not giving the regular iPhone 18 a chance to really shine. By separating the launches by six months, Apple likely hopes that the iPhone 18 will get the attention it deserves, rather than being a more basic version of the shinier, cooler iPhones. 

In reality, we don’t need a new iPhone every year

Now I don’t think this was Apple’s intention by shifting the iPhone 18 launch by six months, but it has really got me thinking; do we really need a new model of iPhone every 12 months? Now, more than ever, probably not. 

Advertisement

Advertisement

The iPhone 17 remains just as capable a smartphone as it was just a year ago. It has a fantastic screen with a smooth 120Hz refresh rate, capable dual 48MP cameras, solid battery life and great performance that still beats much of the Android competition. And, anecdotally, it seems like it’s more popular than ever; I know three people who have bought one in the past six weeks.

And, let’s be honest, the iPhone 18 probably won’t be that much better. It’s not like it was a decade ago when each generation would represent a massive leap forward in tech; nowadays, yearly upgrades are much more incremental – a chip bump here, a slight boost to battery life there – while big overhauls and genuinely shiny new tech are much rarer. 

With that shift, it doesn’t really make as much sense for manufacturers to launch new phones every 12 months. I’d argue that waiting a little longer and implementing more meaningful upgrades and tweaks would be the far better play. Let’s make phone launches genuinely interesting again, guys. 

That said, with the launch of the iPhone 18 Pro, there are newer generations of iPhone now available, and the iPhone 17 is a year old, so a price cut to reflect this slightly older status would’ve been a nice way to placate fans. 

Advertisement

But instead, Apple quietly did the opposite, raising the price of the iPhone 17 – along with the iPhone Air and iPhone 16 – by £100 in the UK and $100 in the US following Wednesday’s event. I mean, I get it: RAM and storage are more expensive than ever, and the new iPhones are also £/$100 more than last year, but it does feel a bit cheeky.

Advertisement

Either way, I do think that Apple was right to delay the launch of the iPhone 18 – though likely not for the same reasons as those at Apple Park. 

Advertisement

Microsoft Excel users report that this week’s KB5002914 Office security update is breaking copy-and-paste operations and formula dragging, with affected users saying that removing or rolling back the update restores normal functionality.

Microsoft released the security update this week as part of its September 2026 Patch Tuesday, and reports of the problem soon appeared on both Reddit and the Microsoft Q&A forums.

“It seems that security update kb5002914 might have bricked autofill and copy paste in Excel 2016,” a Reddit user reported.

Other users confirmed similar problems, with one saying copy and paste and formula dragging no longer worked and that their entire team was blocked after most employees had already installed the update.

Another user reported that copy/paste shortcuts and formula dragging no longer worked.

Similar reports have appeared in the Microsoft Q&A forums, where users say copying and pasting no longer work after the September 9 update.

Reports indicate the problem isn’t limited to a single Office release or installation method.

One user reported the same issue on Office LTSC Standard 2021, while another said it affects both MSI and Click-to-Run installations and Office versions ranging from 2016 through 2024.

Removing or rolling back the update restores functionality

Affected users report that uninstalling KB5002914 from MSI-based Office installations restores Excel’s copy-and-paste functionality.

One Microsoft Q&A user shared the following PowerShell command for removing the update:

& "C:\Program Files\Common Files\Microsoft Shared\OFFICE16\Oarpmany.exe" /removereleaseinpatch "{90160000-0012-0000-1000-0000000FF1CE}" "{27882596-A8ED-4382-9C71-6CD2DD19F732}" '1036' "0"

“This worked for me; copy-and-paste is working again,” the user reported.

For Click-to-Run installations, another user said downgrading the Office build using XML or Group Policy also resolves the problem.

Another workaround being shared among affected users involves leaving KB5002914 installed but replacing the updated excel.exe executable with an older version.

BleepingComputer does not recommend using this workaround, as replacing individual Office binaries with files from an older version could leave the installation with mismatched files and potentially cause other stability, compatibility, or security problems.

Microsoft told BleepingComputer that it is aware of the reports and is investigating, and will share guidance as it becomes available.

Update 9/11/26: Microsoft has now formally acknowledged the bug, adding it as a known issue to the KB5002914 release notes.

“In Microsoft Excel 2024, 2021, 2019, and 2016, the paste operation might fail silently. Although users try to paste content, the source remains selected and the destination is unmodified. When this issue occurs, users receive no indication of the failure, such as a beep or error message. Microsoft is researching the issue and will post more information in this article when the information becomes available.”

Join Mikko Hyppönen and security leaders from the NFL, CHANEL, and Atlassian for a two-hour digital summit on what AI-speed attacks change, what defenders should stop doing, and how to validate, decide, fix, and re-validate at machine speed.

Save your seat

With phone prices climbing higher than ever, it’s no wonder most people turn to carrier financing to buy a new phone. Not only can you spread out your payments over time, but cellular companies often offer enticing deals to win customers over, especially if you’re switching to a new provider. Depending on the deal, sometimes you can even get your new phone for free. 

But those deals can be a little confusing, and involve caveats and rules that aren’t always clear. Very rarely is a discount given without a catch. You might also come across terms like “bill credits” or “trade-in credits” that you don’t fully understand.

If you want to know what these terms mean or other details, like what happens if you decide to switch carriers midplan, read on as we walk you through what you need to know before accepting a new carrier deal. 

This article was made possible in part by T-Mobile. It was written and edited independently without partner oversight.

What is carrier financing?

Simply put, instead of paying up front for a new phone, carrier financing lets you pay for the phone over time through an installment plan. So, for example, if a phone is $1,200, you can spread the cost over 24 months, which translates to just $50 a month. That’s a lot easier for most people to manage. 

It’s worth noting that you will still need to pay upfront costs, like activation fees and taxes on the new phone, whether you’re on an installment plan or not. Sometimes carriers do offer deals that let you spread that out over time. T-Mobile, for example, has the Equipment Installation Plan Flex 36 that will spread out the payment of the device, fees and taxes over 36 months, making the initial cost zero. That said, you still need to qualify for the plan, and depending on your credit, you could have to pay interest on top of that. 

One particular downside of carrier financing is that it locks you into that carrier for an extended period (usually two to three years). This means you can’t use your phone with another carrier during this time. If you want to end your agreement with the carrier, that will usually result in early termination fees, or ETFs. 

Being stuck with a carrier-locked phone is sometimes bad news if you travel a lot and want to use international eSIMs, which only work with unlocked phones. Otherwise, you’ll have to use your carrier’s international data plan, which can be more expensive. 

What are trade-ins and bill credits?

When shopping around for new phones, you might see the words “bill credit” or “trade-in credit” advertised by a carrier. For example, a carrier might offer a trade-in credit of up to $1,000 if you trade in your existing iPhone for a new one. Then they might say that the trade-in credit will be paid to you as 24- or 36-month bill credits. 

What does all of that mean? First, let’s talk about that trade-in credit. Not all phones will be eligible for one. Often, the carrier will only give a trade-in credit for newer phones. The newer the device, the more trade-in credit you will get. So that out-of-date iPhone 11, for example, probably won’t be worth very much, if at all. 

It’s also worth looking into what else is required for you to get that trade-in credit. Sometimes carriers will only offer the trade-in credit if you sign up for a more expensive monthly plan with services you might not need. Other times, however, the carrier just wants you to switch over, so you might not need to do that. 

Let’s say you agree to the terms and the carrier offers you that $1,000 trade-in credit. Here’s where bill credits come in. If the carrier says the trade-in credit will be paid over 36 months of bill credits, it means that $1,000 will be paid off over the period of 36 months. You won’t get a lump sum of that $1,000 credit instantly, and the credits you do get can’t be cashed out and can only be used toward the amount of your phone bill.

But let’s say you don’t have a phone to trade in at all. You could still save some money if you don’t mind switching carriers. Sometimes carriers will offer to pay for your device as an incentive to switch over to their company. Again, device payments are often applied as bill credits spread over a 24- or 36-month period. 

What happens if I pay off my plan early?

You can certainly pay off the remaining balance on your phone if you don’t mind paying the upfront cost. However, be warned that you’ll also forfeit any remaining credits you received for the device you traded in. You could also forfeit any other discounts that you agreed to upon signing up for the plan. Be sure to read through the early payoff rules before deciding to pay off your phone ahead of schedule. 

What if I want to switch carriers?

If you want to switch carriers while you’re in an existing installment plan, you might have to pay ETFs to end your current agreement. However, most major carriers like T-Mobile, AT&T and Verizon will offer carrier-switching incentives where they’ll pay your ETFs for you. Bear in mind that there’s often a cap on how much of the ETF they will cover. The payment is also often in the form of bill credits. 

You can take advantage of carrier deals when choosing this route. T-Mobile, for example, has a five-year price guarantee that locks in the price of text, talk and data for at least five years. AT&T is also attempting to draw new customers with a modular Build-A-Plan that lets you customize your plan according to your budget. Verizon recently introduced Simplicity, an unlimited phone plan that usually costs $45 a month, but is just $30 a month for new customers who bring their own number. 

I started my career with CNET all the way back in 2005, when the (original) Motorola Razrs were all the rage. Since then, I’ve written about everything from consumer electronics to internet culture for outlets like CNET, Engadget and Yahoo. Outside of work, I’m a big fan of baseball, board games, tabletop RPGs and improv comedy.

See full bio

Doom is such a simple, beautifully designed game that it can run on all sorts of weird things, from pregnancy tests to potatoes. Weird things can play it, too. In an effort to eternally one-up itself, the community has now gotten a map of a fruit fly’s brain to play the 1993 first-person shooter.

It started with Google, which partnered with HHMI Janelia Research and other collaborators to map the brain and central nervous system of a male fruit fly. This mapping, which is weirdly beautiful, contains 11,700 types of neurons and 166,000 neurons overall, breaking the record for the most complex neuron mapping ever done. 

The research is pretty cool: It involved taking very thin slices of a fly’s brain and body, imaging them and using AI to combine the millions of 2D images into 3D neural shapes. Google says that “knowing the structure of the brain allows neuroscientists to understand the mechanisms behind brain function.”

Now, make it play Doom

It turns out that knowing the structure of the male fruit fly brain can also help modders and developers teach it how to play Doom. A few days after Google dropped its fly brain research, software engineer Alex Wormuth created a simulated fly brain using Google’s map and then set it loose to learn how to play the pioneering FPS. 

The process is quite complicated. Each frame of the game generates 3,335 brightness inputs and 811 R8 color inputs. These inputs are fed into the simulated fruit fly brain, which contains 25.6 million connections. These inputs hit specific neurons based on what the frame shows, and that information is used to determine which controls the fly uses. This process repeats each frame the game runs. 

It even works with pain. Wormuth says that nonfatal damage targets the PPL101 dopamine receptors, which control hunger and aggression in real fruit flies. 

You can watch the fly’s progress in learning how to play Doom on Wormuth’s Doomfly website, which also shows sensory input, neural activity and other metrics so you can watch the simulated fly brain work in real time. If you swap to the 3D view, you can watch the fly shoot demons.

Flying high with other games, too

Doom isn’t the only game that a simulated fly brain is learning how to play. Developer Jessica Paquette set up a similar neural network with the fly’s brain to learn how to play Super Mario 64, while mechanistic interpretability researcher Lyra Bubbles made another one learn how to play Beat Saber. 

A few days later, X user David began teaching it how to do an escape room, and another, Shashank Jain, taught it how to play soccer. Wormuth came back a couple of days later and gave the fly brain $100 worth of bitcoin to trade to see what it would do. X user Simba made the fly brain deploy its own cryptocurrency token on Robinhood. 

The fly brain experiment is going to have a lot more impact in neuroscience in the long run, but for at least the next few weeks, don’t be surprised if you see headlines about a fruit fly brain learning how to do other random stuff, like creating real fonts that you can download right now or putting it in music videos and letting it dance.

Joe is a freelance journalist. It all started with a long-running affection for building his own PCs, which he did for the first time as a teenager. It evolved into a lifelong enjoyment of putting words on the internet about the subject. He’s written for CNET, PCMag, Mashable and SlashGear as a freelance writer, and worked as a Senior Editor at Android Authority for 10 years. When he’s not writing about tech and science, he’s learning the ins and outs of DIY home repair, gaming, playing his bass guitars and posting help on PC building and gaming subreddits. He is a staunch believer that orange juice should have pulp.

See full bio

A reputable free VPN can be enough when its privacy practices and usage limits fit your needs. Paying generally buys more capacity, server choice, simultaneous connections, support, and advanced features, but it does not automatically make a VPN more private, secure, or faster.

The useful comparison is therefore not simply “$0 versus subscription.” You need to separate privacy evidence from product limits, distinguish an explicit speed restriction from congestion, and compare what a paid plan actually costs rather than relying on its advertised monthly equivalent.

Free VPN vs Paid VPN: What Actually Changes?

A virtual private network, or VPN, creates an encrypted tunnel between your device and a VPN server when the service and protocol are configured to provide that protection. Free and paid tiers from the same provider can use the same core VPN technology, while differing substantially in capacity, location choice, connection limits, and additional features.

Proton VPN is a useful example. Proton states that its free plan uses the same security level and no-logs policy as its paid plans, without a data, time, or routine speed limit. Its paid tiers add capabilities including broader server choice, more simultaneous devices, paid-plan streaming support, BitTorrent support, and advanced features. Proton’s free-versus-paid plan documentation also states that the free tier is limited to one device at a time.

That distinction matters because a free tier from an established provider is not necessarily a technically weaker VPN. Its main compromises may instead be data allowance, location control, device count, server availability, support, or premium functions.

Free VPN vs paid VPN at a glance

There is no universal winner in that table. A free tier with unlimited data can be entirely adequate for one person, while someone who needs several simultaneous connections, precise exit locations, or paid-only features may encounter its limits immediately.

Privacy: Paying Does Not Automatically Make a VPN Trustworthy

Price is a poor shortcut for privacy. When a VPN is active, traffic is routed through infrastructure operated by the VPN provider, so the provider occupies a position of significant trust.

The U.S. Federal Trade Commission explains that a VPN can shift trust away from the local network or internet provider and toward the VPN operator. It also warns that VPN apps may request sensitive permissions, may share information with third parties, and do not make users completely anonymous. Although that guidance was published in 2018, its basic trust model remains applicable. The FTC’s VPN privacy guidance recommends examining the operator and its practices rather than relying on privacy marketing alone.

Recent research also shows why implementation matters. Work presented at USENIX Security 2026 describes observed VPN failure modes including real-IP leakage during tunnel failures, Domain Name System (DNS) queries escaping the tunnel, cleartext traffic, insecure configuration delivery, and advertising-ID exfiltration in the apps and providers studied. The USENIX Security 2026 presentation supports evaluating technical behavior rather than assuming that a paid label establishes security.

When a provider says it keeps “no logs,” check what that statement covers. A no-logs policy can address browsing activity and VPN-session information while the service still retains limited operational account data needed to administer an account or enforce a plan.

Windscribe provides a concrete example. It says a free account can retain a username, hashed password, an email address if supplied, the total bandwidth used during the current period, and a timestamp of last activity. It separately says it does not retain visited sites, DNS queries, the user’s real IP address, or traffic-linked session logs. Windscribe’s free-plan disclosure shows why operational records and browsing-activity logs should not be treated as the same thing.

Independent assessments can strengthen a provider’s claim, but they have a defined scope and date. Proton says its no-logs infrastructure completed a fifth consecutive annual third-party audit in 2026. Proton’s published audit history links the 2026 assessment and earlier reports. That is more useful evidence than an unsupported slogan, but it is not a permanent guarantee about every future app version or security failure.

Whether a VPN is free or paid, examine the provider’s privacy policy, ownership, requested application permissions, independent assessments where available, and the specificity of its technical claims. A subscription receipt is not privacy evidence.

Free VPN Limits: Data, Servers, Devices, and Features

The word “limit” can describe several different restrictions. A data cap limits how much traffic you can use during a period. A device limit controls concurrent connections. A server restriction limits the locations or infrastructure available to the account. None of those automatically means that every connection is deliberately slowed.

Windscribe uses a data-cap model. Its current free-plan page states that an account receives 2 GB per month without a confirmed email address or 10 GB per month with one, and that the free account can be used across unlimited personal devices. Its free server selection is smaller than the paid network. Windscribe documents the allowance and free-tier restrictions.

Windscribe’s current pages do not agree on the exact number of free countries: its main free-plan page lists 10, while a May 2026 support article says 11. Because the provider’s own documentation conflicts, the exact country count is not used here.

Proton takes a different approach. Its free plan has no monthly data ceiling, while paid service expands location choice, increases the connection allowance to as many as 10 devices on eligible paid plans, and adds features unavailable to free users. Proton’s VPN privacy policy says the free service generally has no speed restrictions but reserves the right to impose restrictions in cases of excessive consumption to maintain service quality on free servers.

The practical difference becomes clearer when you consider real workloads. A monthly allowance can be consumed by video, operating-system downloads, cloud synchronization, application updates, or other background traffic even when browsing itself is light. An unlimited-data plan avoids that particular constraint but can still restrict server selection, concurrent devices, or premium functionality.

Different services impose those restrictions in different combinations, so compare free VPN data allowances, device limits, and server restrictions rather than assuming every free tier makes the same compromise.

Speed: Why Paying Can Help Without Guaranteeing a Faster VPN

A paid tier can have a practical performance advantage when it provides access to more servers, additional locations, or infrastructure unavailable to free users. That does not establish a fixed speed difference between free and paid VPNs.

Throughput is the amount of data transferred over time. Latency is the delay between sending network traffic and receiving a response. Both can change because of server distance, congestion, protocol choice, internet routing, Wi-Fi conditions, packet loss, device processing limits, and the underlying connection.

A free plan can introduce another constraint. If free users share a smaller server pool, congestion can become more noticeable when demand rises. A provider can also impose an explicit free-tier speed restriction. Those are different mechanisms: congestion varies with load, while throttling deliberately limits performance according to a rule.

Proton is a useful counterexample to the blanket claim that free VPNs are always throttled. Its current documentation says it imposes no routine speed limit on Proton VPN Free, although free servers can have more users and its privacy policy reserves an excessive-consumption restriction. Paid plans provide broader server access and are marketed as offering faster performance. That supports a narrower conclusion: paying can give you more performance options, but it does not guarantee a particular speed.

No first-hand speed measurements were supplied for this article, so there is no defensible universal percentage showing how much faster a paid VPN is.

If performance is poor, price alone does not identify the cause. Server load, distance, protocol selection, local Wi-Fi, packet loss, routing, Maximum Transmission Unit (MTU) problems, and device processing can produce similar symptoms. VPN slowdown troubleshooting is therefore more useful than upgrading blindly when the problem has not been isolated.

Cost: Compare the Real Bill, Not Just the Monthly Headline

A free VPN has no subscription charge, but paid VPN pricing still requires careful comparison because providers use different billing structures.

Mullvad uses a simple model. In February 2026, it stated that its price remains €5 per month regardless of how long a customer pays for. Mullvad’s pricing statement makes the payment term and monthly rate relatively straightforward.

Windscribe illustrates a different structure. Its May 2026 pricing documentation lists Pro at $9 per month or $69 per year and describes Build-A-Plan as having a $3 minimum purchase. Windscribe’s current pricing explanation shows how monthly, annual, and configurable plans can coexist within one service.

Those prices should not be read as a direct cheapest-provider ranking because they use different currencies, products, and billing structures. Instead, use them to identify what needs checking before you buy:

• the amount charged at checkout;
• how long that payment covers;
• whether the advertised monthly figure requires annual or multi-year prepayment;
• the renewal price after any introductory period;
• whether tax is additional;
• and whether the plan includes services you do not need.

Some VPN pricing pages are also localized by region, currency, or promotion. Treat any quoted price as a dated snapshot and verify the checkout terms before purchasing.

When a Free VPN Is Enough

A reputable free plan can be sufficient when its documented restrictions do not interfere with what you need to do. Examples include light or occasional use, one device on a service with a one-device limit, or routine browsing where you do not need a specific exit location.

The data model matters. Proton’s unlimited allowance removes the need to monitor a monthly data meter, while Windscribe can accommodate multiple personal devices but applies a monthly data allowance to its standard free accounts.

The important qualification is reputable. A free application that provides little information about its operator, funding model, privacy practices, permissions, or technical controls should not be treated as equivalent to a documented freemium service merely because both cost $0.

A free VPN becomes a poor fit when you repeatedly exhaust its data allowance, cannot select a required location, exceed its connection limit, or need a feature reserved for paying accounts. At that point, the relevant question is whether paying removes a constraint you actually encounter.

When Paying for a VPN Is Worth It

A paid VPN is easier to justify when its additional capacity solves a specific problem. That can include sustained high-volume use, several simultaneous devices, access to particular server locations, broader P2P support, advanced routing options, or customer support unavailable on the free tier.

Paying can also reduce recurring friction. If you repeatedly disconnect one device to connect another, exhaust a monthly allowance, or cannot access a suitable server location, a paid plan may remove those constraints.

Do not pay solely because a product is described as “premium.” Identify the limitation you need removed, verify that the paid tier actually removes it, and compare the billing terms with alternatives.

Once a paid service fits your requirements better, compare VPN privacy evidence, device limits, protocols, features, and subscription terms rather than treating payment itself as the deciding factor.

Start with provider trust, then compare your data volume, device count, required locations, performance needs, and additional features. If a reputable free tier satisfies those requirements, paying may add little practical value. If one of its restrictions repeatedly interferes with normal use, a well-vetted paid plan is usually the more practical choice.

Surfshark disclosed that hackers accessed one of its internal test servers after a configuration error exposed it to the internet.

The VPN service provider said the incident did not affect its customers and did not extend to other parts of its infrastructure, but it exposed service configurations and build-related credentials.

“Due to a human error, an internal test server used by our engineering teams was misconfigured in a way that made it reachable from the internet,” Surfshark explained on its website.

The exposed environment also contained portions of system binaries and code history.

Surfshark said that the unauthorized party accessed a separate server used for content-accessibility optimization. The machine acted as a proxy and did not have access to any sensitive data, like user identity, IP addresses, encryption keys, or browsing traffic.

The company did not specify which specific binaries, configurations, services, credentials, or files were exposed, but confirmed that production VPN infrastructure and customer data were not impacted.

“Personal information was never held and accessible from here [the breached server], VPN traffic and browsing activity are not logged or retained in the first place, and the apps and browser extensions on your devices were not altered in any way,” the VPN vendor assured.

The company detected suspicious activity on August 31 and contained the incident on September 2. Three days later, the company completed the remediation process.

It also said there was no evidence that the exposed credentials had been misused or that the compromise had spread to other systems.

In response to the incident, Surfshark rotated all internal credentials that may have been impacted, revoked the exposed tokens, and implemented additional threat detection, activity monitoring, and system hardening measures.

These measures include implementing production-level security controls to test environments, improving build-process credential management, and commissioning an independent audit of its broader infrastructure.

Surfshark promised to provide further updates if the ongoing investigation reveals additional important findings.

Based on the published information, Surfshark users do not need to take any action to protect their accounts. However, vigilance against suspicious activity or unsolicited communications is still recommended.

Join Mikko Hyppönen and security leaders from the NFL, CHANEL, and Atlassian for a two-hour digital summit on what AI-speed attacks change, what defenders should stop doing, and how to validate, decide, fix, and re-validate at machine speed.

Save your seat