NEWS
FreeBSD dhclient Bug Hands Root to Anyone on Your Wi-Fi
The FreeBSD Project pushed an emergency patch on April 29, 2026 for a flaw in its default DHCP client that hands full root access to anyone sharing the same network. CVE-2026-42511 carries a CVSS 3.1 base score of 8.1 and lets a rogue DHCP server slip arbitrary commands into a lease file. Those commands run as root the next time the machine reboots. Every currently supported FreeBSD branch is on the patch list.
Joshua Rogers of the AISLE Research Team filed the disclosure, his third FreeBSD advisory of the same release cycle. There is no software workaround for hosts that must keep running dhclient(8). Administrators have to install the patch or block rogue DHCP servers at the switch.
- 8.1 CVSS 3.1 base score, rated High by the NVD entry for CVE-2026-42511.
- Four supported FreeBSD branches in scope: 13.5, 14.3, 14.4, and 15.0.
- April 29, 2026 patch date across every fixed branch.
- Zero working software workarounds for hosts that must keep running dhclient.
- 24,529 companies tracked as FreeBSD users in enterprise telemetry data.
How a Quote Mark Becomes Root
Dhclient(8), FreeBSD’s default IPv4 DHCP client, is where the fault lives. When a host joins a network, it pulls down configuration data and writes part of that response, the BOOTP file field, into a local lease file at /var/db/dhclient.leases.<interface>.
The advisory describes the parser failure plainly. “The BOOTP file field is written to the lease file without escaping embedded double-quotes, allowing injection of arbitrary dhclient.conf directives,” reads the FreeBSD-SA-26:12.dhclient advisory issued April 30, 2026. Translation: a malicious DHCP server can stuff a closing quote into the filename, then append any directive it wants.
Once the lease file is re-read, dhclient hands those directives to dhclient-script(8). That script runs as root. Any shell command the attacker injected runs with it.
The weakness sits in CWE-149 Improper Neutralization of Quoting Syntax, the same general bug class that breaks SQL escapers and shell quoters. It is a 1990s-era oversight surfacing in 2026 plumbing.

Every Supported Branch Is on the Patch List
The advisory covers four release lines and three stable branches simultaneously. Anything older than 13.5 is already out of support and will not receive a fix.
| Branch | Vulnerable Up To | Patched Version |
|---|---|---|
| FreeBSD 15.0-RELEASE | 15.0-p6 | 15.0-RELEASE-p7 |
| FreeBSD 14.4-RELEASE | 14.4-p2 | 14.4-RELEASE-p3 |
| FreeBSD 14.3-RELEASE | 14.3-p11 | 14.3-RELEASE-p12 |
| FreeBSD 13.5-RELEASE | 13.5-p12 | 13.5-RELEASE-p13 |
STABLE branches received the same fix on the same day. Hosts running 14.4-STABLE, 14.3-STABLE, 13.5-STABLE, or 15.0-STABLE need a fresh build dated after April 29, 2026 to clear the bug.
Why a Coffee Shop Network Is Now a Root Shell
Exploitation is tame on paper and scary in practice. The attacker needs Layer 2 reach, meaning the same broadcast domain as the target. A shared office Wi-Fi qualifies. So does an apartment complex network, a hotel, a campus dorm, an airport lounge, or any switch where a hostile guest can plug in a laptop.
From there the steps are mechanical. Spin up a rogue DHCP server. Race the legitimate one to answer a victim’s DHCPDISCOVER. Craft a BOOTP file field that closes a quote and injects a directive. Wait.
The catalogue of consequences from a successful root execution reads like a standard worst-case set:
- Persistent backdoors written into rc.d boot scripts.
- Ransomware staged on local volumes with encryption keys keyed to the host.
- SSH key exfiltration for lateral movement into a corporate VPN.
- Silent installation of a kernel module that hides processes from ps.
- Pivot tooling dropped into /tmp for spreading to other FreeBSD hosts.
From a threat-intelligence point of view, this maps onto MITRE ATT&CK technique T1557 for Adversary-in-the-Middle and T1059 for Command and Scripting Interpreter. Both are well-trodden by ransomware crews and targeted intrusion teams.
The CVSS vector tells the same story differently. AV:N marks it remotely reachable on the broadcast network. AC:H reflects the rogue-server requirement. PR:N and UI:N mean no privileges or user clicks needed. C:H/I:H/A:H is full compromise of confidentiality, integrity, and availability.
The Reboot Is the Real Detonator
A detail worth dwelling on: the malicious payload does not run when dhclient first picks up the lease. It runs when the lease file is re-parsed. That usually means the next reboot, the next ifconfig down/up, or a manual service restart.
Wire writeups treat this as a footnote. It is the entire risk profile. A laptop can be poisoned at a coffee shop on Tuesday, walk back into the corporate network clean, and detonate root execution on Friday morning when the user reboots after a patch cycle. There is no obvious connection between the network the attacker used and the system that fires the payload.
“You can look at a code base and even if you can’t trigger a bug or a vulnerability, you can still say it’s wrong.”
Rogers said that line on the Open Source Security podcast episode on AI-assisted vulnerability discovery in October 2025, talking about how he runs source-code analyzers across mature open-source projects. The dhclient parsing logic is exactly the kind of looks-wrong code path that survived for years because nobody could spell out a working exploit.
An AI-Assisted Hunt Cracked dhclient
Rogers, a 12-year veteran of Linux and FreeBSD security work, runs his current research through the AISLE AI-native cybersecurity platform. His personal disclosure log and services page shows three CVEs against FreeBSD in the past two release cycles, including CVE-2026-42511, CVE-2026-42512, and CVE-2026-39457.
“You’re not just some chuckle head that’s like shoveling something into AI and just dumping what comes out into GitHub issues,” said Josh Bressers, host of the Open Source Security podcast and a long-time application-security practitioner. The point matters because triage teams are already drowning in low-quality AI-generated bug reports. Rogers’ productivity, by contrast, is producing High-severity advisories that ship same-day patches.
Patch in Under Five Minutes
Updating is the priority. There are two supported paths, depending on how the system was installed.
- Base packages (FreeBSD 15.0 amd64/arm64): run
pkg upgrade -r FreeBSD-baseas root, then reboot. - Binary distributions (everything else): run
freebsd-update fetch, thenfreebsd-update install, then reboot. - Source builds: sync to the appropriate stable-branch tag dated after April 29, 2026, rebuild world, install, reboot.
- Lease cleanup: remove existing /var/db/dhclient.leases.* files before the reboot, since a poisoned lease can fire even on patched binaries if the file already contains the injected directive.
That last step is the one most writeups skip. The patch fixes the parser, not the disk. A lease file already containing an injected directive will still load the next time dhclient starts. Deleting the file is cheap and forces a clean DHCP exchange against a trusted server.
Containers and jails inherit the host’s dhclient binary. They get the fix when the host is updated, but any container that runs its own dhclient under chroot needs the same purge of cached lease files.
Hosts that do not run dhclient at all, including most cloud images that take their network configuration from the hypervisor metadata service, are unaffected. A quick check is service dhclient status or pgrep dhclient. No process, no exposure.
DHCP Snooping Is the Network Backstop
For fleets that cannot reboot quickly, the network has the kill switch. DHCP snooping on managed switches treats every port as untrusted by default and only permits DHCP server traffic on the uplinks where real DHCP servers live. Juniper’s Junos OS configuration example for protecting against rogue DHCP server attacks walks through the trusted-port model used across Cisco, Juniper, Arista, and most modern enterprise gear.
The feature blocks rogue DHCP responses at Layer 2 before they reach the FreeBSD host. It also keeps DHCP starvation attacks and DHCP-based pivot tooling out of the picture as a side benefit. For environments where reboots are expensive, snooping is the practical mitigation while patches roll through change windows.
Who Actually Runs FreeBSD
The number of affected systems is harder to pin down than for Linux. W3Techs’ April 2026 FreeBSD usage data for the top 10 million sites measures it on roughly 0.05 percent of public-facing web servers, a small share that hides a concentrated population of high-value hosts.
FreeBSD’s installed base skews toward infrastructure. Netflix’s content-delivery edge runs on it. WhatsApp’s backend famously did. So do parts of Sony’s PlayStation network stack, Juniper’s Junos OS, and the pfSense and OPNsense firewall distributions. None of those public-facing edges are the immediate concern, since hardened CDN nodes do not run dhclient against a hostile network.
The exposed population is the workstation and developer-laptop segment. Researchers, sysadmins, BSD enthusiasts, and small operations teams who carry a FreeBSD machine onto a hotel network are the population the bug class was designed to hit. So are FreeBSD-based appliances that ship with dhclient on their WAN interface.
Higher education is the single largest FreeBSD vertical by company count, with research universities running it on lab and infrastructure hardware. A university’s open campus Wi-Fi is also one of the most generous broadcast domains a rogue DHCP attacker could ask for.
That combination makes the patch a real-world priority and not the theoretical one its low macroscopic share might suggest.
Frequently Asked Questions
Am I Affected if My Server Doesn’t Use DHCP?
No. CVE-2026-42511 fires only on hosts running dhclient(8) against an attacker-controlled DHCP server. Cloud instances on AWS, GCP, and most VPS providers pull network config from a hypervisor metadata channel, not dhclient, and are not exposed. Run pgrep dhclient on each host. If nothing returns, the bug cannot reach you. Patch anyway when you next update, since the fix ships in the base system.
Will the Fix Roll Out Through freebsd-update Automatically?
Only if you run freebsd-update on a schedule. The fix shipped April 29, 2026 across 13.5, 14.3, 14.4, and 15.0. Hosts on 15.0 amd64 or arm64 base packages need pkg upgrade -r FreeBSD-base; everything else uses freebsd-update fetch followed by freebsd-update install. Reboot after either. Then delete /var/db/dhclient.leases.* to clear any pre-poisoned lease.
Can a Hotel Wi-Fi Really Compromise My Laptop?
Yes, if the laptop runs FreeBSD with dhclient and the hotel network has no DHCP snooping. The attacker only needs a laptop on the same broadcast domain and a rogue DHCP daemon. The payload does not detonate immediately; it waits for a reboot or a network restart. Use a USB-tethered phone, a personal hotspot, or a wired upstream you control until the host is patched.
Do Jails and Bhyve VMs Need Their Own Patch?
Jails inherit the host’s dhclient binary and clear once the host is patched. Bhyve VMs running their own FreeBSD install need their own freebsd-update cycle. If a jail or VM caches its own /var/db/dhclient.leases.* file, delete that file before the next ifconfig down/up, even on a patched binary. The poisoned lease can still fire if the disk copy is unchanged.
Is There a Public Exploit Yet?
No public proof-of-concept code has been published as of May 6, 2026, six days after disclosure. Rogers has not released an exploit and the FreeBSD advisory does not include one. The bug class is well understood and the fix diff is public, so working exploits should be assumed within days. Treat the patch window as urgent rather than discretionary.
Rogers’ advisory is a tidy demonstration of how a string-handling oversight from the BOOTP era survived three decades and four major FreeBSD branches. The patch is small, the disclosure is clean, and the fix is one reboot away. Whether the lease files on disk get the same scrub is the part operations teams will quietly handle this week.
NEWS
Utah’s VPN Crackdown Hits Today: Best VPNs For The Beehive State
The law landed today. As of Wednesday morning, May 6, 2026, Utah’s Online Age Verification Amendments are live, and the state is the first in the country to write VPN traffic directly into a child-protection statute.
Senate Bill 73, signed by Governor Spencer Cox on March 19, 2026, treats anyone physically inside Utah as a Utah user, no matter whether their connection exits in Provo or Prague. The law also bars covered sites from telling Utahns how a VPN works. Privacy groups call this combination a liability trap.
For everyone else in the state, the case for a VPN didn’t change. Public Wi-Fi still leaks. Internet providers still log. Streaming libraries still vary by region. We benchmarked the three names most Utah readers will see this week against real local conditions, and here is where each one lands.
What Senate Bill 73 Actually Does
The bill targets sites hosting a substantial portion of material harmful to minors, a phrase carried from Utah’s earlier statute, Senate Bill 287 from 2023. SB 73 adds two new layers. First, it deems a user located in Utah if their physical body is inside state lines, regardless of what their IP address says. Second, it forbids covered sites from publishing instructions, tutorials, or FAQ entries explaining how a VPN can sidestep an age check. The full statutory text is in the Utah Legislature’s enrolled SB 73 PDF.
The penalty math is steep. Utah’s Division of Consumer Protection can fine non-compliant sites $2,500 for a first offense and $5,000 per repeat violation, with a 2% excise tax flowing into a new Minor Mental Health Restricted Account inside the state’s General Fund. The bill’s chief sponsor, Senator Calvin R. Musselman, framed those numbers as protective rather than punitive in his floor remarks during the 2026 General Session, which are mirrored on the SB 73 status and history page.
The earlier law, SB 287, survived federal court review in late 2024 after a judge dismissed an industry challenge. Pornhub, then the eighth most-visited website on the internet, responded by geo-blocking Utah entirely rather than collect government ID at the door. SB 73 closes the back door that survived: a quiet VPN session pointed at a server two states over.

Why a VPN Still Earns Its Keep in Utah
The new statute didn’t outlaw VPNs. Using one in Utah is still legal, and the everyday reasons to run one didn’t move an inch.
Public Wi-Fi at the airport in Salt Lake City and the coffee shops along 9th and 9th still passes plaintext metadata to anyone with a packet sniffer. Comcast, CenturyLink, and the regional carriers servicing rural Utah still log DNS queries and sell anonymized aggregates downstream. Streaming libraries on Netflix, Disney+, and Prime Video still split content between US, UK, and Canadian catalogs, and a VPN remains the cleanest way around that fence.
Reporters covering domestic-violence shelters, immigration attorneys handling sensitive intake, and survivors of abuse all rely on the same tool to keep an IP address from doubling as a home address. The Electronic Frontier Foundation, in its April 2026 analysis of the new statute, warned that punishing sites for ordinary VPN traffic sweeps those people up alongside teenagers chasing adult content.
Free VPNs are not a neutral fallback. Audited, paid services log nothing meaningful and pay for the bandwidth themselves; free apps usually pay for it by selling user data to ad brokers. The three picks below all run independently audited no-logs policies and accept anonymous payment.
NordVPN: The Local Server Heavyweight
If raw speed inside Utah is the deciding factor, NordVPN’s server map and protocol documentation back up the marketing. The provider runs more than 30 servers in Utah alone and 74 across North America, the deepest US bench in the consumer market. On our test rig the proprietary NordLynx protocol pushed 1,249 Mbps locally and held 688 Mbps on a US-to-UK route, fast enough to keep 4K streams stable on a household with three active users.
- 1,249 Mbps peak local speed on NordLynx during May 2026 testing.
- 30+ Utah-based servers, the largest in-state footprint of any major consumer VPN.
- $3.09 per month on the longest-term plan, audited no-logs policy verified by Deloitte in 2024.
- US Netflix, Prime Video, Disney+, Peacock all unblocked from a Utah connection point.
ExpressVPN: The Long-Distance Privacy Pick
Where Nord wins on local muscle, ExpressVPN’s North American infrastructure documentation wins on cross-border throughput. The company runs servers in 71 North American locations including Utah, and on long hauls its Lightway Turbo protocol clocked 1,177 Mbps on our Windows test machine. On the same US-to-UK route where Nord dropped to 688 Mbps, Express held 1,117 Mbps.
There’s a catch. Lightway Turbo is currently Windows-only. Mac, Linux, iOS, and Android users fall back to standard Lightway, which is slower but still strong. Streaming coverage is broad if quirky: Express unblocks US YouTube where Nord currently fails, and Express misses US Prime Video where Nord succeeds. Pick on the streaming service you actually use.
The privacy posture is the strictest in the field. ExpressVPN’s TrustedServer architecture wipes every node on every reboot, and the company survived the 2017 Turkish server seizure with zero data recovered, a real-world stress test no competitor can match.
Private Internet Access: The Budget Workhorse
For Utahns who want audited privacy without a premium subscription, Private Internet Access’s transparency reports and server list remain the most honest budget pick. PIA runs servers in 60 US locations including Utah, and its court-tested no-logs policy has been verified in three separate US criminal subpoena cases since 2016.
Speed is the trade-off. Our WireGuard test peaked at 447 Mbps locally and 326 Mbps on a transatlantic route, less than half what Nord and Express deliver. Streaming coverage misses US Prime Video and Disney+. For a Utah resident who needs daily privacy hygiene rather than 4K binge sessions, PIA’s per-month pricing undercuts the premium tier by more than half.
Why the Industry Is Furious
VPN companies and digital-rights groups don’t usually sit on the same side of a policy fight. SB 73 changed that.
The Compliance Paradox
NordVPN’s public statement, issued ahead of the May 6 effective date, called the law unenforceable on its face. Blocking every known VPN and proxy IP in Utah is, in the company’s words, technically impossible because providers add new addresses faster than any blocklist can absorb them.
Any legislation that cannot be complied with is not a workable measure. It is a liability trap. Good intentions written into technically unenforceable law fail to protect minors and instead simply punish lawful users who care about their privacy, globally.
The practical fallout, as NordVPN’s spokesperson framed it in the same statement, is that covered sites face two bad options. Block all known VPN exit nodes and lose legitimate paying users worldwide, or demand government ID from every visitor regardless of state, exporting Utah’s age check to Berlin and Buenos Aires.
The Speech Restriction
The second VPN provision is the one civil liberties groups find more constitutionally suspect. SB 73 forbids covered sites from publishing information about how VPNs work in the context of bypassing age checks. The EFF described that clause as a content-based restriction on truthful speech about a lawful product, the kind of rule that historically loses on First Amendment review.
Legal observers expect a challenge within weeks. NetChoice, the trade group that has filed against age-verification statutes in California, Texas, Mississippi, and Ohio, has not formally announced action on SB 73 but rarely sits out a state-level speech case. The EFF has signaled it will support any plaintiff that draws Utah into federal court.
Utah Senator Calvin R. Musselman, the bill’s chief sponsor, has defended the speech provision as narrow and tailored to commercial pornography sites rather than general internet speech. The law’s text supports that reading, but the line between a covered site and a non-covered site is what courts will fight over.
Tighten Your Setup This Week
Whichever provider you pick, three settings carry most of the privacy load. Skip them and the rest of the subscription stops mattering.
- Switch to a modern protocol. WireGuard, NordLynx, or Lightway in your client settings. The legacy OpenVPN options still work, but they’re slower and easier to fingerprint at the network layer.
- Turn the kill switch on. If the VPN tunnel drops for a tenth of a second, the kill switch cuts your internet rather than letting your real IP leak to whatever site you were reading. It’s the single most important checkbox in any VPN app.
- Enable auto-connect on launch. Set the client to start with your operating system and connect automatically. Two seconds of unprotected traffic at boot is enough for an ISP, an analytics broker, or a public-Wi-Fi attacker to pin a profile to your device.
Frequently Asked Questions
Is It Illegal To Use A VPN In Utah After May 6?
No. SB 73 doesn’t ban VPNs and doesn’t penalize you for running one. The law puts the legal liability on websites that host adult content, not on individuals using a privacy tool. You can install NordVPN, ExpressVPN, PIA, or any other audited service in Utah today and use it for streaming, banking, and travel exactly as before.
Will Adult Sites Still Work In Utah If I Use A VPN?
It depends on the site. Pornhub and most major adult platforms have geo-blocked Utah outright since 2023 rather than verify IDs. Some sites will now layer global ID checks on top of those blocks to limit liability. Routing through a non-Utah VPN server may still reach those sites, but expect more identity prompts and more dead ends than before.
Does SB 73 Affect Non-Adult Websites?
Not directly. The statute only covers commercial entities hosting a substantial portion of material harmful to minors. Mainstream sites like YouTube, Reddit, and Netflix sit outside that definition. The constitutional concern raised by the EFF is that the speech restriction could chill broader VPN coverage online if other sites self-censor to avoid being swept in.
What Happens If My VPN Connection Drops Mid-Session?
Without a kill switch, your device falls back to your real IP for whatever fraction of a second the tunnel is down, exposing your location and traffic to your ISP and any site you’re connected to. With a kill switch enabled, your internet is cut entirely until the VPN reconnects. Turn the kill switch on inside your VPN app’s settings before doing anything sensitive.
Are Free VPNs Safe Enough For Utah?
Usually no. Independent audits of free VPN apps have repeatedly found embedded ad trackers, weak encryption, and shared data pipelines with brokers. Run a reputable free tier from a paid provider (Proton VPN’s free plan is the common pick) rather than a no-name app from a phone store. The audited paid services start under $4 per month on annual plans, which is cheaper than the cost of a serious data leak.
Utah just put a flag in the ground that no other US state has tried, and the legal sequel will play out in federal court rather than the legislature. The practical question for Utah residents this week is narrower. The privacy tool you already had is the same privacy tool you have today, and the three picks above cover the speed, security, and budget ends of the field. Set up the protocol, the kill switch, and the auto-connect, and the rest sorts itself out.
Disclaimer: This article is for general informational purposes and does not constitute legal advice. Utah’s Online Age Verification Amendments may be amended, enjoined, or interpreted differently by the courts after publication. Specific provisions, fines, and enforcement practices cited reflect public sources as of May 6, 2026 and may change. Readers with specific compliance, employment, or legal questions about Senate Bill 73 should consult a licensed Utah attorney before acting.
APPS
Audible Faces Nationwide Class Action Over Expiring Credits
Audible customers asked a federal judge in Seattle this week to certify a nationwide class action over audiobook credits that vanish after twelve months. The motion, filed in Hollis v. Audible Inc. in the U.S. District Court for the Western District of Washington, could put Amazon on the hook for every U.S. subscriber whose credits expired since December 4, 2020.
Plaintiffs say Audible’s credits qualify as gift certificates under RCW 19.240.030’s prohibition on expiring vouchers. Individual losses run from about $20 to $380. The judge already rejected Audible’s first attempt to dismiss. If granted, certification would bundle millions of forfeited credits into a single damages claim.
That matters because Audible has a lot riding on it. The $14.95-a-month subsidiary controls roughly two-thirds of U.S. audiobook revenue. It is also fighting an antitrust case in Manhattan and a separate California complaint over what “buying” an audiobook actually means. The credit case is the cheapest one for Amazon to lose.
What the Class Certification Motion Asks the Court to Do
Four named plaintiffs led by Jonathon Hollis filed the certification motion in early May, asking to represent every U.S. resident who lost an Audible credit after December 4, 2020. The proposed class covers both monthly subscribers and annual members who paid Audible directly, not through an app store.
The motion presses the theory that survived dismissal: credits are vouchers exchangeable for audiobooks, and Washington bans expiring vouchers. Plaintiffs are represented by Jonas Jacobson, Simon Franzini, Gabriel Doble and Stephen Ferruolo of Dovel & Luner’s class action practice, a Los Angeles firm that says it has won more than 85% of its trials and arbitrations.
Plaintiffs seek classwide damages, attorney fees, and treble damages under Washington’s Consumer Protection Act. The proposed class is tied to the original Hollis complaint filed in December 2024, which framed the credits as classic gift certificates dressed up in subscription clothing.

Why Washington’s Gift Certificate Law Is the Hammer
Washington’s gift certificate statute is one of the strictest in the country. The law makes it unlawful to issue or enforce a gift certificate carrying an expiration date, with narrow carve-outs for genuine loyalty rewards and donations to charity.
The definition is what bites Audible. A gift certificate is any voucher exchangeable for goods or services. The statute does not require a fixed cash value. It does not require transferability. That broad reach is the door plaintiffs walked through, and it is the door Audible cannot close on appeal without a legislative change.
Numbers in the case explain the urgency:
- $20 to $380: the per-class-member damages range plaintiffs estimate
- December 4, 2020: the start date for the proposed class period
- 12 months: the lifespan of a Premium Plus credit before it disappears
- $25,000: Washington’s cap on the treble multiplier per Consumer Protection Act violation
The CPA gives plaintiffs a parallel path to liability. RCW 19.86.090 on civil damages and treble damages lets injured consumers recover actual losses, attorney fees, and up to three times their damages, capped at $25,000 per violation. Treble damages do not require malice. They require a showing the unfair practice harmed the public interest.
Audible’s expiration policy is buried in its membership terms. Plaintiffs argue most subscribers never see it until a credit they paid for is gone, which is the kind of opaque practice the CPA was written to police.
The App Store Loophole That Complicates Audible’s Defense
Audible’s own help center contains a quirk that cuts against its position in court. Credits do not expire when users subscribe through the Apple App Store or Google Play. Apple and Google’s billing rules forbid expiring digital balances, so Audible adapts. Subscribe to Audible’s Premium Plus membership benefits page directly, and the same credit dies after twelve months.
That asymmetry is awkward. It shows Audible can run a no-expiration model. The company chooses not to on the channel where Apple and Google are not forcing its hand.
- Apple App Store subscribers: credits never expire
- Google Play subscribers: credits never expire
- Direct audible.com subscribers: credits expire after 12 months
Inside the Class and the Money at Stake
The proposed class is large and easy to identify. Audible’s billing system already records every credit issued, redeemed, or expired by user. Plaintiffs argue that internal data alone proves commonality and predominance under Federal Rule 23, the threshold for nationwide certification.
The damages calculation works like this. A Premium Plus monthly credit costs roughly $14.95 in cash terms. A subscriber who lost two credits before redemption is out about $30. Annual plan members who let unused credits roll into a 24-credit pile and then forfeited eight of them sit closer to the $380 ceiling cited in the complaint.
Audible has not disclosed how many U.S. credits expired in the proposed class period, but the math compounds quickly. Audible holds 63.4% of U.S. audiobook revenue per Grand View Research’s 2024 audiobooks market analysis. If even one in twenty active U.S. subscribers lost a single credit, gross damages move past nine figures before any treble multiplier.
The class is also unusual for what it excludes. App Store and Play Store subscribers are out, because their credits never expire in the first place. That carve-out narrows the class to direct Audible billing customers, the channel where Amazon collects the full retail margin without paying Apple’s 15% to 30% cut.
The Argument Audible Tried That the Judge Threw Out
Audible’s central defense was that its credits cannot be gift certificates because they have no fixed cash value. A credit redeems for one audiobook regardless of that book’s list price. That elasticity, Audible argued, takes credits outside the statute. U.S. District Judge Tana Lin disagreed in her 2025 order denying the motion to dismiss, finding the statute requires neither fixed cash value nor transferability.
“Whether or not the Legislature intended for the gift certificate statute to only apply to vouchers which are transferable, it did not include such a requirement in its definition of ‘gift certificate.'”
Judge Lin’s order is the spine of the certification motion. If credits are gift certificates, expiration is unlawful. If expiration is unlawful, every forfeited credit since December 2020 becomes a damages claim. The certification fight is now whether one Seattle courtroom can resolve those claims in a single proceeding.
A Second Front in Amazon’s Audiobook Legal Battles
The credit case is one of three live legal threats stacked against Audible. In June 2025, U.S. District Judge Jennifer L. Rochon refused to dismiss an antitrust suit in Manhattan accusing Audible of monopolizing audiobook distribution. The complaint targets Audible’s exclusivity bonus, which pays a 40% royalty for 90-day exclusives and only 25% for non-exclusive titles.
A separate California class action alleges Audible misleads buyers into thinking they own the audiobooks they purchase when they receive only a license. That case revives a familiar argument from the Kindle and PlayStation worlds: when a digital store says “buy,” what is the consumer actually getting?
Audible’s broader response has been to diversify its subscription menu. The company recently launched a cheaper Standard tier at $8.99 a month that gives access to the Plus catalog without per-title credits. Standard sidesteps the credit-expiration problem entirely. It does not, however, fix the credits already lost by Premium Plus members for the past five years.
What Subscribers Should Do With Their Credits Right Now
Whatever the court does, the practical move for Premium Plus members is to clear the queue. Credits are most valuable when redeemed for higher-priced titles, and any credit older than eleven months is days from disappearing.
Audible’s customer support has historically restored expired credits on request as a one-time courtesy, but the policy is unwritten and discretionary. The litigation does not change that.
- Check your credit expirations: Sign in at audible.com, open My Library, and review the Credits tab for issue dates.
- Redeem oldest credits first: The first credit issued is the first to expire under Audible’s accounting.
- Use credits on premium titles: A credit applied to a $40 release captures more value than one used on a $9 sale title.
- Pause instead of canceling: A 90-day pause keeps existing credits intact, while cancellation forfeits them at cycle end.
- Save proof of expired credits: Screenshots and email receipts will matter if and when class notices go out.
For App Store and Google Play subscribers, none of this applies. Their credits sit indefinitely.
For everyone else, the expiration clock is still running. The class action, if certified, will sweep up past losses. It will not stop a credit issued today from disappearing on May 6, 2027.
Frequently Asked Questions
Do Audible Credits Really Expire After A Year?
Yes. Audible Premium Plus credits purchased directly from audible.com or Amazon expire 12 months after they post to your account, and the company’s help center confirms it. Credits bought through the Apple App Store or Google Play are an exception and never expire. To check your dates, sign in at audible.com, open My Library, and review the Credits tab.
How Do I Know If I Qualify For The Class Action?
You may qualify if you are a U.S. resident who held a direct Audible subscription and lost a credit to expiration anytime after December 4, 2020. App store subscribers do not qualify. The court has not yet certified the class, so there is nothing to file today. Watch the docket in Hollis v. Audible Inc., Case No. 2:24-cv-01999, or sign up for class notices through Dovel & Luner.
What Happens To My Credits If I Cancel Audible?
Any unused credits expire at the end of your final billing cycle when you cancel a direct membership. To save them, redeem them before the cycle ends, or pause your membership for up to three months instead. Credits earned through Apple or Google billing remain available regardless of cancellation, because both stores forbid expiring digital balances.
Can I Get An Expired Credit Restored Without Joining The Lawsuit?
Sometimes. Audible customer support has historically restored expired credits as a one-time courtesy when contacted within a reasonable window. Call 1-888-283-5051 or open the help chat at help.audible.com. There is no guarantee. A restored credit also carries a fresh 12-month clock, so redeem it quickly before it expires again.
The motion now sits with Judge Lin and could move on a multi-month timeline. Class certification rulings typically arrive 6 to 12 months after briefing closes, with discovery on Audible’s credit-expiration data running in parallel. Until then, every credit a Premium Plus member loses is one more entry in a record Amazon may eventually have to pay for.
Disclaimer: This article reports on pending litigation and is for informational purposes only. It does not constitute legal advice. Consumers who believe they may qualify as class members should consult a licensed attorney before taking action and watch the official court docket for class certification updates. Settlement amounts, eligibility criteria, and case outcomes can change as the case progresses, and any figures cited reflect publicly available filings as of publication.
NEWS
Samsung’s 500 PPI Sensor OLED Reads Pulse And Blocks Snoopers
Samsung Display revealed an upgraded Sensor OLED panel at Display Week 2026 on Tuesday in Los Angeles. The 6.8-inch screen reads heart rate and blood pressure through organic photodiodes baked into the panel, hides sensitive data from side viewers with Flex Magic Pixel privacy tech, and now hits 500 pixels per inch.
The pixel density climbed 33 percent in twelve months, up from last year’s 374 PPI prototype. That figure matters because it pushes a fully sensor-integrated phone screen close to a production-ready spec for the first time. Handset makers can now plan around it without rebuilding their hardware.
A Phone Screen That Reads Your Pulse
Samsung calls the panel Sensor OLED Display. It stitches OLED pixels and organic photodiode sensors into a single layer through a co-deposition process. The same manufacturing run produces both the picture-making layer and the light-detecting layer.
Place a fingertip on the screen and the display’s own emitted light bounces off the blood vessels in your finger. Some of that light returns to the panel. The OPD captures it, software reads the pattern as a photoplethysmography waveform, and the system extracts pulse and blood pressure off the rhythm.
The version Samsung Display showed press on May 5, 2026 also captures fingerprints anywhere across the screen rather than at a single anchor point. There is no separate ultrasonic module. The whole 6.8-inch surface becomes the sensor.
That is the point. The screen is not just showing data. It is collecting it.

From 374 PPI To 500 PPI In Twelve Months
Samsung Display’s previous Sensor OLED prototype, shown at Display Week 2025, ran at 374 pixels per inch. The new panel reaches 500 PPI. That’s a 33 percent jump inside a single product cycle, and it solves the practical problem that kept this technology in the lab.
At 6.8 inches across, the panel matches the screen size of every flagship Android device shipping today, including the Galaxy S26 Ultra released March 11, 2026. OEMs don’t need to rework their chassis tooling, their batteries, or their thermal layouts to adopt it.
- 500 PPI: matches mainstream flagship AMOLED resolution
- 6.8 inches: identical diagonal to the Galaxy S26 Ultra
- 33 percent: PPI gain over the 2025 prototype
- One layer: RGB and OPD pixels integrated through co-deposition
A Samsung Display spokesperson said in the company announcement that integrating two pixel types into a single layer was the central engineering challenge. Advanced panel design and precise process control technologies, the spokesperson said, are what unlocked the 500 PPI threshold.
Why Privacy Tech Is Riding Shotgun
A screen that reads your pulse is also a screen that displays your pulse. Samsung knows the data shown on a panel measuring health metrics is suddenly worth shielding. So the new Sensor OLED ships with Flex Magic Pixel embedded in the same panel.
The technology pairs narrow-angle and wide-angle subpixels. Switch on privacy mode and the wide-angle subpixels go dark, restricting the photon spread to a tight cone aimed at the user’s face. UL Solutions, an independent safety certifier, measured Samsung’s panel at 3.5 percent side-to-front brightness ratio at 45 degrees and below 0.9 percent at 60 degrees. Samsung Display’s UL Solutions privacy display verification announcement documented the test in February 2026.
The Galaxy S26 Ultra was the first commercial smartphone to ship with Flex Magic Pixel. The new Sensor OLED prototype takes the same idea further. Instead of darkening the entire screen at angle, FMP can selectively blur only the regions showing private data while leaving the rest visible. A glance from the next seat catches your wallpaper. The blood pressure number stays hidden.
Inside Samsung’s Display Week Lineup
The Sensor OLED was not Samsung Display’s only headliner at the Los Angeles Convention Center. The Korean panel maker walked into the I-Zone with a wider lineup that signaled where Galaxy and beyond are heading. “We are pleased to present our latest technologies and R&D achievements to global experts and industry leaders at SID 2026,” said Changhee Lee, Executive Vice President and Chief Technology Officer at Samsung Display, in Samsung Display’s official Display Week 2026 announcement.
Flex Chroma Pixel hit 3,000 nits in High Brightness Mode while covering 96 percent of the BT.2020 color gamut. Most commercial smartphone OLEDs cover roughly 70 percent today. Two EL-QD prototypes, an 18-inch and a 6.5-inch panel, pushed self-emissive quantum dot displays to 500 nits, a 25 percent gain on last year’s reference. A 200 PPI stretchable Micro-LED panel was pitched at automotive instrument clusters.
Here’s a quick scoreboard of the prototypes that matter most for phones and tablets.
| Prototype | Size | Headline Spec | Use Case |
|---|---|---|---|
| Sensor OLED | 6.8 in | 500 PPI, OPD layer | Phone health sensing |
| Flex Chroma Pixel | smartphone class | 3,000 nits, 96% BT.2020 | Phone HDR and outdoor visibility |
| EL-QD | 6.5 in / 18 in | 500 nits self-emissive | Tablets and monitors |
| Stretchable Micro-LED | variable | 200 PPI, deformable | Auto dashboards |
Samsung Display also collected SID’s Display of the Year award for its TriFold dual-folding panel, the screen anchoring its Galaxy Z TriFold from late 2025. The combined message at Display Week was uncomplicated. Korea’s panel duopoly intends to keep selling the most advanced screens money can buy in 2026.
The Cuffless Blood Pressure Race Just Got A Bigger Player
Samsung is not the first to claim a phone or wearable can read blood pressure without a cuff. The FDA cleared the Aktiia Hilo Band on July 24, 2025, the first cuffless OTC blood pressure monitor green-lit for U.S. consumers and rolling out in 2026 according to Aktiia’s PR Newswire FDA clearance announcement. Smartphone apps using camera-based optical sensing have already cleared the AAMI/ESH/ISO clinical accuracy bar in peer-reviewed work.
Researchers Kim, Lee and colleagues, writing in a February 2025 Nature Communications study on multi-point OLED photoplethysmography, reported that an array of organic photodiodes integrated directly into the display can match medical-grade devices in pilot trials.
The system offers easy usability with a sensing time of 15 seconds and supports multiple functions including high-accuracy screening for cardiovascular diseases and blood pressure monitoring from both fingers, with no restrictions when using a single smartphone.
What Samsung is signaling is structural integration rather than a separate accessory category. A wrist band measures the person wearing it. A panel embedded across every flagship handset measures hundreds of millions. If the next Galaxy or two ship with Sensor OLED, smartphones could become a primary cardiovascular screening tool.
When Could This Land On Your Phone
Samsung Display has not committed to a commercialization timeline for Sensor OLED. The 374 PPI prototype shown in 2025 never reached production. The 500 PPI version unveiled this week is closer to phone-ready than anything before it, but Samsung Electronics, the handset arm, still has to qualify the panel, build the regulatory case for any health claim, and price the panel into a flagship bill of materials.
The Galaxy S27 Ultra cycle, expected around February 2027, is the earliest realistic window. Even then the first commercial implementation may launch with heart rate only, leaving the trickier blood pressure feature for a later refresh once Samsung clears the FDA bar that in-display sensing rivals like Metalenz’s Polar ID under-display camera are also pursuing in 2026.
Frequently Asked Questions
When will Samsung phones get the Sensor OLED display?
Samsung Display has not announced a commercialization date. The 500 PPI prototype shown at Display Week on May 5, 2026 is engineering-ready, but Samsung Electronics still has to qualify the panel and clear health-claim regulators. The earliest realistic window is the Galaxy S27 Ultra in February 2027, and even that first wave may ship with heart rate sensing only and add blood pressure later.
How accurate is blood pressure on a phone screen compared to a cuff?
Independent peer-reviewed work suggests it can reach clinical-grade accuracy. Lausanne University Hospital’s OptiBP AAMI/ESH/ISO smartphone validation study reported a bias and standard deviation of 0.39±7.30 mm Hg systolic and -0.20±6.00 mm Hg diastolic against cuff references, inside the 5±8 mm Hg threshold. Samsung’s specific Sensor OLED panel has not yet been independently validated against the same protocol.
Does the Galaxy S26 Ultra already read blood pressure through the screen?
No. The S26 Ultra, released March 11, 2026, ships with the Flex Magic Pixel privacy display only. The blood pressure and heart rate sensing layer demoed at Display Week 2026 is a separate prototype panel that has not yet been integrated into a shipping Galaxy device. Samsung Health still uses the rear optical sensor and the Galaxy Watch for cardiovascular metrics.
Can someone next to me see my health data on a Sensor OLED screen?
No, not on the prototype Samsung showed. Flex Magic Pixel selectively blurs the regions of the panel displaying private data, including health metrics, while leaving the rest of the screen visible at front view. UL Solutions verified that side-to-front brightness drops to 3.5 percent at 45 degrees and below 0.9 percent at 60 degrees, effectively black from a shoulder-surfer’s angle.
Is reading heart rate through a phone screen safe?
Yes. The same OLED light that displays your wallpaper does the sensing. There is no extra laser or higher-intensity emitter, so the optical exposure is identical to normal screen viewing. The technology is the same class of measurement already used in the Galaxy Watch, the Apple Watch, and FDA-cleared cuffless monitors like the Aktiia Hilo Band.
Display Week 2026 turned screens into sensors first and viewports second. Samsung’s 500 PPI Sensor OLED is the highest-resolution take on that idea anyone has shown the press. The panel may not arrive in your pocket until the Galaxy S27 cycle, but the direction of travel is clear. Phones are about to start reading you back.
Disclaimer: This article reports on display industry announcements and peer-reviewed research and does not constitute medical advice. Cuffless and screen-based blood pressure technologies vary in accuracy, regulatory status, and clinical validation across markets. Anyone managing hypertension or other cardiovascular conditions should consult a licensed healthcare professional and continue to use medical-grade monitoring tools. Specifications, regulatory clearances, and product timelines cited are accurate as of publication and may change.
-
APPS2 days agoGoogle’s Buried Page Reveals 500 Niche Websites Still Making Cash
-
AI2 days agoGPT-5.5 Catches Mythos On Cyber Tests, ARC Reveals Brittle Logic
-
AI2 days agoSubquadratic Launches A 12-Million-Token AI Model And Says The Wall Is Gone
-
CRYPTO2 days agoAndreessen Horowitz Bets $2.2B on Crypto’s Quiet Cycle
-
CRYPTO2 days agoWells Fargo Says Circle Is Crypto’s Underappreciated Winner
-
NEWS2 days agoMetalenz Polar ID Hides Face Unlock Under OLED Smartphone Screens
-
GAMING2 days agoAsha Sharma Reshuffles Xbox Leadership In Race To Project Helix
-
NEWS2 days agoHormuud Bets $19 Down Will Finally Pull Somalia Online
