Could someone hijack your router from the street — what is the WPSplinter flaw and what should you do tonight?

A newly public flaw nicknamed WPSplinter, in Broadcom Wi-Fi code used for WPS, can let someone within Wi-Fi range run code on some older routers without your password. You cannot patch it yourself tonight — turn WPS off, update the firmware, ask your provider about a fix for your exact model, and replace or bridge a router the maker has abandoned.

You are watching TV, the Wi-Fi feels fine, and nobody in the house knows a stranger parked outside could be talking to your router. Short answer: yes — on some older routers, a newly public flaw nicknamed WPSplinter, in Broadcom Wi-Fi code used for WPS (the push-button way to join Wi-Fi), can let someone within Wi-Fi range run code on a vulnerable router without your password. You cannot patch it yourself tonight, but you can lower the risk in about ten minutes.

Researcher Quentin Kaiser disclosed WPSplinter in October 2026 after reporting it in July; he demonstrated reading a Wi-Fi password and opening a remote shell on gateways from Belgian providers, counted about 1.5 million vulnerable devices in Belgium alone, and said the same Broadcom chips are in routers worldwide from makers including Cisco, Netgear, Nokia, Sagemcom, TP-Link, ZTE and Zyxel. Broadcom says it replaced the old code in 2018, Kaiser says that fix was incomplete, and simply turning WPS off may not fully close the hole on affected models.1. In your router app or admin page, turn WPS OFF anyway — it is good hygiene and stops the easy WPS PIN attacks.2.

Check for a firmware update in the app or admin page and install it; turn on automatic updates if offered.3. If your internet provider supplied the router, ask them whether your exact model has a WPSplinter fix — get a yes/no in writing in the chat or app if you can.4. If the router is old, unsupported, or the provider cannot confirm a fix, put the provider box in bridge mode if available and use your own up-to-date router behind it, or replace the router — that is the step Kaiser himself suggested for uncertain firmware.5.

Change the router admin password from any default, and keep a strong, unique Wi-Fi password — note that changing the Wi-Fi password alone does NOT fix this flaw; it just helps generally.Pro tip: Do not panic-buy the first router you see tonight. First check the model and firmware — many newer routers already use newer code. The mistake is assuming ‘WPS is off, so I am done’ on a model the maker no longer updates.Ad’s take: I tell folks the router is the front door nobody thinks about.

Ten minutes checking firmware tonight beats wondering later why your whole house felt exposed — start there, and replace the box only if it truly has been abandoned.