This popular VPN has been hit by a major security vulnerability