Customers of ExpressVPN have been notified of a vulnerability in the most recent version of the Windows app that permitted some DNS requests to be routed to a third-party server, usually the user’s internet service provider (ISP). After a reviewer pointed out that there might be a problem with the way the app handles DNS requests for users who have “split tunneling enabled,” ExpressVPN’s engineers swiftly released a fix for the Version 12 app for Windows.

Source: GBHackers